One stolen vendor credential opened 173 Microsoft 365 tenants last week. ConnectWise Cloud Backup, formerly SkyKick, had its OAuth app secret taken. On 15 October the attacker signed in as the application and pulled Microsoft Graph tokens, working through tenants in sorted order, seconds apart. Nobody was phished and no MFA prompt fired. The sign-ins inherited the permissions customers had granted the backup app: mail, files, Teams, directory data. ConnectWise has revoked the app's certificates, suspending customer backups. Huntress warns the credential works in every tenant where the app is consented. https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html #CyberSecurity #InfoSec #SupplyChain #Microsoft365