Stolen ConnectWise app credentials open Microsoft 365 tenants across MSP customers
Huntress found on October 15 and 16, 2026 that an attacker was signing in as the ConnectWise Cloud Backup (formerly SkyKick) Entra application with a credential that lived in the vendor's own tenant, obtaining Microsoft Graph tokens in customer tenants; in one tenant a second ConnectWise app granted itself Global Administrator and added secrets to other applications. ConnectWise disabled the app identities, and Microsoft said on October 21 that Storm-0940 used stolen ConnectWise application identities and the ARTEX agentic AI framework, in some cases reaching privileged cloud access in under three hours.
- Victim
- ConnectWise and Microsoft 365 tenants of its customers
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Oct 15, 2026
- First disclosed
- Oct 16, 2026
- Actor
- Storm-0940, China-state aligned (per Microsoft); Huntress has not tied all activity to one operator (Nation-state)
- Initial access
- Third-party access
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A vendor's multi-tenant app credential was a skeleton key to every tenant that had consented to it. Reviewing third-party service principals' permissions, restricting them with conditional access for workload identities, and alerting on directory role changes by apps are the controls.
Go deeper on SWI
- Product involved: Microsoft Entra ID
- SWI coverage: one connectwise app credential opened microsoft 365 tenants across msp customers
- SWI coverage: storm 0940 used connectwise app identities to reach 2250 microsoft 365 tenants
Sources
- ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks, Huntress, Oct 16, 2026
- AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, Microsoft Security Blog, Oct 21, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Commvault Metallic breach exposes Microsoft 365 app secrets 2025 · Third-party access
- US Treasury workstations accessed through a stolen BeyondTrust Remote Support key 2024 · Third-party access
- Danish CPR register queried through a private company's abused access 2026 · Third-party access
- Cisco Duo SMS MFA logs stolen from a phished telephony provider 2024 · Third-party access
Cite this record
SWI Community Team. (2026). Stolen ConnectWise app credentials open Microsoft 365 tenants across MSP customers. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-connectwise-cloud-backup-app-credential/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.