Hackers Used a Trusted Backup App to Access Microsoft 365 — How? Cybersecurity Today

How did attackers use a trusted cloud backup application to gain unauthorized access to Microsoft 365 environments—without compromising ordinary user passwords or triggering user MFA? In this episode of Cybersecurity Today, we examine the ConnectWise Cloud Backup incident, the findings reported by Huntress, and the broader security risks associated with privileged application identities. We explore how application credentials work, why third-party cloud permissions matter, how attackers may establish persistence through additional credentials, and the defensive actions organizations should consider. **Important:** Confirmed unauthorized sign-ins do not establish that every affected organization suffered data theft. The investigation remains ongoing. Reporting is current through October 17, 2026. **Sources:** Huntress Investigation: https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access ConnectWise Advisory: https://www.connectwise.com/company/trust/advisories BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/ Subscribe to Cybersecurity Today for evidence-based cybersecurity news and analysis. Stay informed. Stay skeptical. And stay secure. #CybersecurityToday, #Microsoft365, #Cybersecurity, #CloudSecurity, #ConnectWise, #DataSecurity, #CyberThreats, #MicrosoftEntra, 00:00 – Can Your Backup Software Become an Attack Path? 00:45 – ConnectWise's Latest Security Response 01:50 – Backup Service Disruption and Recovery Risks 03:00 – How Trusted Applications Access Microsoft 365 04:00 – Application Credentials and Microsoft Graph Access 05:00 – Huntress Discovers Suspicious Authentication 05:40 – What the Authentication Findings Really Mean 06:15 – Administrator Privileges and Hidden Persistence 07:40 – The Risks of Trusted Third-Party Applications 08:15 – ConnectWise Containment and Business Continuity 09:45 – Four Defensive Actions for Cloud Security 11:15 – The Growing Risk of Non-Human Identities 12:20 – The Investigation and Unanswered Questions 13:00 – Cybersecurity Today: Final Takeaway 2ZTYNQDSYL73HTFI