> TritonInfoSec News
Home / Oct 18, 2026 / Story
0
#4 BleepingComputer general October 17, 2026 at 15:18 UTC

Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack

By Ionut Ilascu

AI Summary

Threat actors abused a compromised ConnectWise Cloud Backup (formerly SkyKick) application identity to breach 173 Microsoft 365 customer tenants in an active supply-chain attack. ConnectWise has shut down customer access to the Cloud Backup service while investigating, leaving MSPs and their clients without backup functionality. The attack vector — compromised service credentials granting broad OAuth-level access to downstream M365 tenants — underscores the risk of third-party integrations in MSP environments.

Read full article → https://www.bleepingcomputer.com/news/security/hac…

Relevance score: 87.0/100

# More from October 18

  1. 1
    Prolific Chinese espionage group exploits BeyondTrust zero-day CyberScoop
  2. 2
    Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day SecurityWeek
  3. 3
    BeyondTrust patches zero-day exploited in attacks since August BleepingComputer
  4. 5
    Zero-click attacks used targeted ads to deliver Candiru spyware BleepingComputer
  5. 6
    Critical BlockStrap flaw lets hackers run code on Magento servers BleepingComputer
  6. 7
    Drupal patches critical RCE flaws, warns exploits may emerge soon BleepingComputer
  7. 8
    Cybersecurity incident at BAE Systems disrupts US bankruptcy court system CyberScoop
  8. 9
    OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract The Hacker News
  9. 10
    F5, Juniper Networks Patch Critical Vulnerabilities SecurityWeek