thehackernews.com
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Cybersecurity researchers have identified an active campaign in which threat actors compromised a Microsoft 365 credential belonging to ConnectWise Cloud Backup, a service used by managed service providers to back up client data. Using the stolen credential, the attackers signed into 173 tenant environments between 06:13 and 08:34 UTC on 15 October, moving through tenants in GUID order with a scripted approach. The compromised app holds extensive permissions—including full mailbox, OneDrive, SharePoint, Teams, and directory access—allowing the adversary to read and modify data [...]