Who Can Get Into Your Company's Microsoft 365 Without a Password? A Hacked Backup App Targeted 2,250+ Organizations

Every outside app your company has connected to Microsoft 365, whether for backup, e-signatures or email management, holds a key that opens your mail and files without a password and without a verification code. Attackers exploited exactly that this month: they stole credentials for ConnectWise Cloud Backup (formerly SkyKick) applications, used them to target more than 2,250 Microsoft 365 environments worldwide, and in some cases reached Global Administrator rights in under 3 hours. Do three things today: ask your IT lead for the list of apps connected to your account and their permissions, disable anything you do not recognise or no longer use, and check who has been added to the Global Administrator role since October 1.

What exactly happened?

According to Microsoft's security report published on October 21, 2026, the attack was carried out by a China-linked group Microsoft tracks as Storm-0940, using ARTEX, an open-source AI-driven penetration testing tool. Between October 10 and 14 the group ran an automated password-guessing campaign that produced more than 151,000 failed sign-ins against 327 accounts in 8 organizations, peaking on October 11 at about 2,900 attempts a minute.

Then came the more dangerous step. The attackers obtained credentials for ConnectWise Cloud Backup applications, a service that backs up Microsoft 365 mail and files and that many companies use through the IT service providers who run their systems. Because those applications had already been granted consent to reach customer data, the attackers could sign in as the application itself rather than as an employee, so they needed nobody's password and no two-factor code. Once in, they changed application credentials, assigned themselves the Global Administrator role and explored the environment through Microsoft Graph.

How did ConnectWise respond?

According to the official advisories page in the ConnectWise Trust Center, the company discovered the problem on October 14, disclosed it on October 16, and at 07:00 UTC on October 17 disabled seven application identities tied to the service, suspending Cloud Backup along with SaaS Security and Cloud Management. ConnectWise says backup archives remain encrypted and isolated with no indication of compromise, and it is targeting phased partner onboarding from Monday, October 26.

The same advisory contains a sentence every business owner should read: disabling those connections prevents new sign-ins through them, but it does not reverse changes the attacker already made inside your tenant. An admin account the attacker added, or an app whose keys they changed, stays exactly as it is until your own team removes it.

Why this matters even if you never used ConnectWise

This is not a story about one product. Every Microsoft 365 account has a list of outside apps that some employee or admin approved at some point: a signing tool, a scheduling calendar, a backup system, an AI add-on that reads mail. Some of them hold organization-wide permission, meaning they can read every employee's mail and files, and that permission stays in place long after everyone has forgotten the app. If the app's vendor is breached, its key becomes the attacker's key.

There is a second lesson. Companies that relied on Cloud Backup have gone more than a week without the backup service they pay for. If one vendor holds your only copy and also holds the key to your live data, you have stacked two risks in one place.

Five steps to ask your team for this week

• Inventory connected apps: in the Microsoft Entra admin center open Enterprise apps, then All applications, and review the Permissions tab as described in Microsoft's official guide to reviewing app permissions. Start with apps that hold organization-wide permission.
• Disable, do not delete: if you find ConnectWise or SkyKick apps, disable them until the company issues instructions for your service. Microsoft advises keeping the app disabled rather than deleting it so investigation evidence is not lost.
• Review admin roles: ask for a list of everyone holding Global Administrator and any change to it since October 1. You should know every name on it.
• Check the logs: review sign-in and audit logs from at least October 1 and look for activity from 144.172.64.99, 144.172.64.60 and 144.172.64.128, the addresses ConnectWise published. A match does not prove compromise on its own, but it warrants an investigation.
• Stop casual approvals: turn on an admin consent workflow so no employee can give a new app access to company data with one click, as explained in Microsoft's guide to configuring user consent.

If you read our piece on the compromised LiteLLM release, the pattern is the same: the attacker does not break your door, they walk in through a vendor you trust. And if this has you rethinking your backups, see our guide to backup and disaster recovery.

The Origami view

The attackers needed no flaw in Microsoft and no tricked employee here; they used trust that companies themselves granted to an outside app and then forgot. That is why at Origami we treat every integration we build with Microsoft 365 or any cloud platform as a permission that needs a reason, an owner and a review date: the least access the integration needs, keys that rotate, and a clear record of what the app does in your company's name. If you want the apps connected to your company accounts reviewed, or an integration that holds no more than it needs, get in touch.

Sources

• Microsoft Security Blog: Storm-0940 uses ARTEX in ConnectWise supply chain compromise, October 21, 2026
• ConnectWise Trust Center: Cloud Backup service interruption advisory and updates to October 24, 2026
• Microsoft Learn: Review permissions granted to enterprise applications in Microsoft Entra
• Microsoft Learn: Configure how users consent to applications