SC Media
@SCMagazine
A stolen @ConnectWise app credential exposed Microsoft 365 tenants to unauthorized access and privilege escalation. The breach highlights the risks of overprivileged app identities. #cybersecurity #CISO #infosec t.co/Xyi8IHRc6u
// tag
Microsoft 365
Security incidents tagged Microsoft 365. Newest first.
- incidents
- 3
- live
- 1
- patched
- 2
## 1 Microsoft 365 incident in the last 12 months
crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore
- criticallivepartial fixsince Oct 17, 2026
ConnectWise Cloud Backup shut down after M365 app-identity hijack
› ConnectWise Cloud Backup / Microsoft 365 app identity
ConnectWise disabled Cloud Backup after a compromised credential let attackers authenticate as the application and sign in to at least 173 customer Microsoft 365 tenants.
show 2 older incidents2 older incidents
January 2024 1
highMidnight Blizzard breaches Microsoft corporate emailno fix needed
› Microsoft corporate email (Microsoft 365) no fix needed
Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.
May 2023 1
- criticalclosedpatchedclosed Sep 6, 2023
Storm-0558: stolen Microsoft signing key used to read government email
› Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)
China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.
## posts 2
- › ConnectWise Cloud Backup shut down after M365 app-identity hijack
- › ConnectWise Cloud Backup shut down after M365 app-identity hijack
The Register@TheRegisterChina-aligned attackers used AI agents and compromised ConnectWise application creds to target more than 2,250 Microsoft 365 tenants, the vendor says. More here: t.co/CrHYzab3cD
