---
id: "CMP-202610-stolen-connectwise-cloud-backup-skykick-app-credential-used-"
kind: "campaign"
aliases: []
title: "Stolen ConnectWise Cloud Backup (SkyKick) app credential used to break into Microsoft 365 tenants"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "ConnectWise Cloud Backup", "fixed": [], "affected": "M365 tenants with the app consented", "ecosystem": "vendor"}, {"name": "SkyKick Backup", "fixed": [], "affected": "M365 tenants with the app consented", "ecosystem": "vendor"}, {"name": "Microsoft 365", "fixed": [], "affected": "tenants consented to ConnectWise Cloud Backup / Cloud Management apps", "ecosystem": "vendor"}, {"name": "Microsoft Entra ID", "fixed": [], "affected": "tenants consented to ConnectWise Cloud Backup / Cloud Management apps", "ecosystem": "vendor"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: "2026-10-16T00:00:00+00:00"
first_seen_at: "2026-10-26T21:02:41+00:00"
updated_at: "2026-10-26T21:02:41+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-26T21:02:41+00:00"}]
---

# Stolen ConnectWise Cloud Backup (SkyKick) app credential used to break into Microsoft 365 tenants

A Microsoft 365 application secret belonging to ConnectWise Cloud Backup (formerly SkyKick Backup) was compromised and, from about 2026-10-14, used to request app-only Microsoft Graph tokens from customer tenants that had consented to the app; no user password or MFA is needed. On 2026-10-15 the credential was swept across almost 1,000 tenants (user agent Python-urllib/3.12). In some tenants the actor added secrets and certificates to applications, granted itself Global Administrator, and added credentials to other apps (via ConnectWise Cloud Management apps for Exchange Online, Teams, SharePoint, Graph and Partner Center). Microsoft attributes it to Storm-0940 using the ARTEX AI agent framework; Huntress and Sophos confirm the activity. Any organisation or MSP using ConnectWise Cloud Backup / SkyKick for M365 is at risk. How the credential was stolen and what data was taken are unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ConnectWise Cloud Backup affected M365 tenants with the app consented fixed ?
- vendor:SkyKick Backup affected M365 tenants with the app consented fixed ?
- vendor:Microsoft 365 affected tenants consented to ConnectWise Cloud Backup / Cloud Management apps fixed ?
- vendor:Microsoft Entra ID affected tenants consented to ConnectWise Cloud Backup / Cloud Management apps fixed ?

## How to check

- In Entra Admin Center > Enterprise Applications (clear filters), search for Application ID 506e08f9... / "SkyKick" / "ConnectWise Cloud Backup" and the ConnectWise Cloud Management apps (MS Teams app ID 24205314-2b89-4e07-a2a4-579e898a5640).
- Review Monitoring > Sign-in logs > Service principal sign-ins for these app IDs from 2026-10-14 on, including Python-urllib/3.12 user agents.
- Check the directory audit log for new secrets or certificates on any application, Global Administrator role grants to service principals, and deleted service principals.

## Fix

- If you do not need it, remove consent for ConnectWise Cloud Backup / SkyKick and ConnectWise Cloud Management apps; otherwise follow ConnectWise guidance on rotated credentials (status unknown from sources).
- Remove any credentials added to applications and any role grants you did not make; rotate secrets on apps that were touched.
- Enable Microsoft Graph activity logging so future Graph reads are visible.
- Review other third-party multi-tenant apps with broad Graph permissions.

## Timeline

- 2026-10-26T21:02:41+00:00 analyst

## Documents

- [describes] @HuntressLabs: On October 16, we reported the abuse of a ConnectWise Cloud Backup credential to https://x.com/HuntressLabs/status/2114802748885442791
- [describes] Huntress: AI, Scripts, Operator: Inside the ConnectWise Attack https://www.huntress.com/blog/connectwise-attack-ai
- [describes] Huntress: 2026 - October SkyKick (ConnectWise Cloud Backup credential compromise) https://support.huntress.io/hc/en-us/articles/56492265597459-2026-October-SkyKick
- [discussion] @wiz_io: 🚨Wiz Research is tracking Storm-0940, an ARTEX-using actor, as it Expands its ta https://x.com/wiz_io/status/2113284193975255255
- [discussion] @MsftSecIntel: Microsoft Threat Intelligence assesses that China state-aligned threat actor Sto https://x.com/MsftSecIntel/status/2113005667363573823
- [discussion] @MsftSecIntel: The China state-aligned threat actor Storm-0940 used the agentic AI penetration  https://x.com/MsftSecIntel/status/2112975078266716390

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_