Someone stole a credential that ConnectWise’s Cloud Backup service, formerly called SkyKick, uses to connect to customers’ Microsoft 365 accounts, and used it to sign in to businesses’ tenants starting on or around Oct 14, per Huntress. Because those sign-ins came from the backup app itself rather than a person, multifactor login didn’t block them, and the app already had broad permission to read mail, files and Teams chats. Microsoft Threat Intelligence called it an active supply-chain attack, as reported by BleepingComputer. Huntress says it found more than 160 affected business accounts among the customers it watches. How the credential was stolen hasn’t been disclosed.
ConnectWise switched off the affected connections early Saturday and suspended Cloud Backup, SaaS Security and Cloud Management. As of its 11:50 AM PT update today, scheduled backups, archive access and restores are still unavailable, with no restoration date. ConnectWise says its stored backup archives show no sign of being accessed, but stresses that this says nothing about whether your live Microsoft 365 data was touched. That has to be checked tenant by tenant. It also says not to reconnect affected applications until it provides formal restoration instructions. Its next update is due by 6:00 PM PT tonight.
IT managers and MSPs: in the Entra admin center, under Enterprise applications, find the ConnectWise or SkyKick apps using the Application IDs in ConnectWise’s remediation guide and make sure each one is disabled, not deleted. Check service-principal sign-ins (a separate tab from user sign-ins) since Oct 13, and review app credentials, admin role assignments, consent grants and mailbox forwarding rules for anything added recently. Huntress found one case where a ConnectWise app gave itself Global Administrator and added credentials to other apps, and switching the apps off doesn’t remove credentials already added. Huntress’s self-check walks through the steps. Keep the apps off until ConnectWise says it’s safe, and arrange another Microsoft 365 backup in the meantime.
Small-business owners: if an IT company manages your email, ask them today whether they use ConnectWise or SkyKick backup and whether they’ve checked your account. Personal Microsoft accounts aren’t involved.
Businesses running self-hosted BeyondTrust Remote Support, the remote-access tool many help desks use: patch today. CISA says attackers are exploiting a critical flaw in it (CVE-2026-102764) to get in, then dig in and move to other systems, and added it to its exploited list on Friday with a federal deadline of today, Oct 19. BeyondTrust says a suspected China-linked espionage group used it before a fix existed, starting Aug 29. BeyondTrust released the fix Oct 8 and published its advisory Thursday. Its cloud-hosted customers were patched automatically.
IT managers: apply the BT26-05-RS patch from BeyondTrust’s advisory. It covers versions 24.3.1 through 26.2.3; older versions must upgrade first. If you run Privileged Remote Access, BeyondTrust recommends the patch there too. Take the admin interface off the open internet. Because the flaw was used before a patch existed, check the appliance for unknown admin sessions, unfamiliar scripts and gaps in your logs. If you find any, rebuild it and change every password it stored.
Nothing to do at home: both stories involve business systems, not personal PCs or Microsoft accounts.