One ConnectWise app credential opened Microsoft 365 tenants across MSP customers

Huntress reported on October 16 that an attacker was authenticating as the ConnectWise Cloud Backup application (formerly SkyKick) in Microsoft Entra ID tenants with the app's own credential, which works in every tenant that consented to it. Between 06:13 and 08:34 UTC on October 15, the attacker obtained Microsoft Graph tokens from 144.172.64[.]128; Huntress confirmed unauthorized sign-ins in 162 tenants by that evening, a count The Hacker News put at 173 a day later. In one tenant the ConnectWise Cloud Management Teams app added itself to Global Administrator and planted new client secrets on two other apps, one of them Huntress's own. ConnectWise disabled seven app identities on October 17 and suspended Cloud Backup. It has not said how the credential was exposed.

Why it matters

A multi-tenant app is a single credential with access to every customer that clicked "consent". The attacker needed no user, no password and no MFA prompt: the service principal already held mail, files and directory write permissions. Todyl warned that revoking user sessions does nothing here, and tokens already issued stay valid after the app is disabled.

If you or your MSP used SkyKick or ConnectWise Cloud Management, disable (do not delete) the listed app IDs, starting with 506e08f9-6e9a-4da4-942b-a099a03644ae. Check the "Service principal sign-ins" tab, not the default user view, from October 13 on. Audit every app registration for secrets or certificates added since then, and remove any directory role you did not grant. Longer term, cap app secrets with app management policies, put Conditional Access on workload identities, and review third-party consents as non-human identities with owners and expiry.

Source: Huntress