microsoft 3656 articles
Stolen ConnectWise Credential Gives Attackers the Keys to 173 Microsoft 365 Tenants
Unknown threat actors have compromised a Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick), gaining unauthorized access to 173 customer and partner M365 tenants on October 15, 2026. Because the backup application holds broad permissions across mailboxes, OneDrive, SharePoint, and Teams, the attackers inherited extensive access to sensitive data in every affected tenant, with some activity also involving privilege escalation by adding Global Administrator rights and new credentials to other trusted applications. In response, ConnectWise has shut down Cloud Backup application access, while security firms and Microsoft are urging affected organizations to disable the app, audit service principal sign-in logs for the suspicious IP address (144.172.64.128), and review any credential changes made since October 13.
ConnectWise Pulls Cloud Backup Offline After Attackers Hijack Microsoft 365 Tenants
ConnectWise disabled seven application identities and suspended its Cloud Backup and Cloud Management services after unknown threat actors compromised the application credentials and used them to gain unauthorized access to Microsoft 365 customer tenants. The attack is particularly dangerous because the stolen application credentials allowed attackers to authenticate as ConnectWise's own applications and request access tokens from Microsoft Entra ID, potentially enabling access to mailboxes, SharePoint, Teams, and directory data — and even establish persistence by adding new credentials or applications within compromised tenants. Security firm Huntress has confirmed malicious activity across nearly 1,000 Entra tenants, with successful sign-ins in approximately 300, and identified a second targeted wave of attempts focused on 16 tenants in sensitive sectors including national security and critical minerals.
Refused security help, got ransomwared, went bust. Classic.
A small construction company that rejected cybersecurity consulting advice was hit by ransomware weeks later, losing all its data including encrypted backups, and went out of business within months. In a separate incident, attackers used a compromised executive email account to launch a sophisticated phishing campaign against a partner company, employing a man-in-the-middle attack to bypass two-factor authentication. The second attack was thwarted because the target had software in place to detect anomalous logins and revoke access tokens before serious damage could be done.
Fake Passkeys and CEO Impersonation: Microsoft Exposes Two Nasty Cloud Attack Campaigns
Microsoft has revealed two threat actor campaigns targeting organizations: one involving over a million scam emails impersonating CEOs to trick finance departments into making fraudulent ACH transfers, and another using passkey-themed social engineering to compromise Microsoft cloud accounts. The second campaign involves attackers posing as IT helpdesk staff to lure employees into fake Microsoft sign-in pages, enabling credential theft or unauthorized account access, after which they establish persistent MFA footholds and exfiltrate data from SharePoint, OneDrive, and Exchange. Microsoft has linked the activity to multiple threat actors, including Storm-3032 (identified as UNC6671), with overlaps noted in shared phishing infrastructure associated with the cybercrime collective also tracked as Cordial Spider.
Kratos Phishing Kit Dismantled: 200 Servers Down, But 1,800 Customers Still Have the Code
German and US authorities, alongside Indonesian police, have dismantled Kratos, a major phishing-as-a-service platform that enabled around 1,800 criminal customers to run approximately 15,000 phishing campaigns per month, taking more than 200 servers offline and arresting its alleged developer. The kit was particularly dangerous due to its adversary-in-the-middle capability, which stole live Microsoft 365 session cookies alongside credentials, allowing attackers to bypass multi-factor authentication entirely. However, the takedown leaves the kit's existing customer base and their copies of the code untouched, raising concerns that similar operations could resurface under a new name.
EvilTokens Phishing Kit Is Far Nastier Than Anyone Realised
EvilTokens, a device-code phishing kit capable of bypassing multi-factor authentication on Microsoft 365, has been found to be more sophisticated than previously understood, with Cisco Talos uncovering a linked phishing-as-a-service operator panel called "ARToken." Talos revealed how the phishing lures reach victims' inboxes, describing a targeted approach that exploits real vendor relationships and abuses legitimate SharePoint domains to evade detection. Beyond simple credential theft, ARToken includes a comprehensive post-exploitation toolkit with full business email compromise capabilities, making it a complete BEC operations platform rather than just a phishing kit.