Compromised ConnectWise Credential Exposes 173 Microsoft 365 Customer Environments

An active cyber campaign is exploiting a compromised ConnectWise Cloud Backup credential, granting unauthorized access to 173 Microsoft 365 customer environments. Threat actors utilized the credential to acquire Microsoft Graph tokens and conduct reconnaissance, with activity noted on October 15, 2026. Microsoft advises customers to review service principal sign-ins and disable the impacted application until ConnectWise confirms credential resets, highlighting a significant security risk for affected organizations.