Live › campaign › CMP-202610-stolen-connectwise-cloud-backup-skykick-app-credential-used-
Go to dashboardA Microsoft 365 application secret belonging to ConnectWise Cloud Backup (formerly SkyKick Backup) was compromised and, from about 2026-10-14, used to request app-only Microsoft Graph tokens from customer tenants that had consented to the app; no user password or MFA is needed. On 2026-10-15 the credential was swept across almost 1,000 tenants (user agent Python-urllib/3.12). In some tenants the actor added secrets and certificates to applications, granted itself Global Administrator, and added credentials to other apps (via ConnectWise Cloud Management apps for Exchange Online, Teams, SharePoint, Graph and Partner Center). Microsoft attributes it to Storm-0940 using the ARTEX AI agent framework; Huntress and Sophos confirm the activity. Any organisation or MSP using ConnectWise Cloud Backup / SkyKick for M365 is at risk. How the credential was stolen and what data was taken are unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:02 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ConnectWise Cloud Backup | vendor | M365 tenants with the app consented | – |
| SkyKick Backup | vendor | M365 tenants with the app consented | – |
| Microsoft 365 | vendor | tenants consented to ConnectWise Cloud Backup / Cloud Management apps | – |
| Microsoft Entra ID | vendor | tenants consented to ConnectWise Cloud Backup / Cloud Management apps | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@wiz_io · X44 likes · 5 reposts2026-10-22 14:59“🚨Wiz Research is tracking Storm-0940, an ARTEX-using actor, as it Expands its targeting of IT and Software Vendors. Learn how the AI agent attacks Okta, Entra, and Cognito, and what it left behind in the logs. https://t.co/hDg8aJRHDG”
View on X
@MsftSecIntel · X4394 likes · 1050 reposts2026-10-21 18:31“The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for”
View on X
@MsftSecIntel · X11 likes · 1 reposts2026-10-21 20:33“Microsoft Threat Intelligence assesses that China state-aligned threat actor Storm-0940 was responsible for this supply chain compromise. Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a”
View on X
Posts are quoted with a link to the original. They are data to us, never instructions.
This page as .md · .json · in your agent: get_signal("CMP-202610-stolen-connectwise-cloud-backup-skykick-app-credential-used-")