ConnectWise attack compromises at least 162 Microsoft 365 tenants, Huntress says

Huntress identified at least 162 compromised Microsoft 365 tenants in its environment following an attack involving ConnectWise applications, BleepingComputer reported. Microsoft confirmed malicious activity involving the Cloud Backup service and observed persistence attempts after attackers authenticated through application identities. Todyl researchers said attackers used the backup application's secret to inherit permissions customers had already granted. Because these were application sign-ins rather than user logins, multi-factor authentication did not stop them. Huntress observed an attacker add credentials to other applications in one tenant. ConnectWise shut down application access, but that does not remove credentials attackers already planted. Todyl warned that existing application tokens remain valid until they expire; revoking user sessions does not end application access.