Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Cybersecurity researchers have identified an active campaign where threat actors are using a compromised credential from ConnectWise Cloud Backup to gain unauthorized access to Microsoft 365 environments. The compromised credential has been used to sign in to 173 Microsoft 365 tenants. The credential belongs to ConnectWise Cloud Backup, a cloud-based backup and recovery service used by managed service providers. This service was formerly known as SkyKick. The campaign involves unknown threat actors abusing the compromised credential to access customers' Microsoft 365 environments.