Date: 10/20/2026
Severity: High
Summary
Researcher cross-tenant token-sweeping campaign abusing the ConnectWise Cloud Backup (formerly SkyKick) application to obtain Microsoft Graph access tokens across Microsoft 365 tenants that had previously granted consent. The automated activity, observed on October 15, 2026, originated from a single VPS and was consistent with abuse of a compromised vendor-held application credential. This threat actor activity highlights the risk of token theft, credential theft, and potential data theft through app-only tokens, which may expose tenant data without requiring user passwords or MFA.
Indicators of Compromise (IOC) List
IP Address | 144.172.64.128 144.172.64.99 144.172.64.60 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | dstipaddress IN ("144.172.64.128","144.172.64.60","144.172.64.99") or srcipaddress IN ("144.172.64.128","144.172.64.60","144.172.64.99") |
Reference:
Microsoft 365 Cross-Tenant Token Theft