The OAuth Trust Gap: Why MFA Cannot Stop a Compromised Application Identity

A common assumption in Microsoft 365 security programmes is that identity protection primarily means protecting user credentials. Multifactor authentication (MFA), conditional access, and phishing-resistant sign-in flows are all designed around that premise. The ConnectWise Cloud Backup incident exposes the structural limit of that premise: when the attacker is the application, not the user, those controls do not engage. The consequential question for security leadership: how many third-party OAuth applications in their tenants right now carry permissions that would make the same attack possible.

What happened

ConnectWise is an IT management software company whose products (remote monitoring and management, backup, and cloud management tools) are used by thousands of MSPs to administer customer Microsoft 365 environments at scale.

In a post on X, threat intelligence researchers reported that attackers compromised application identities within ConnectWise's Cloud Backup environment (formerly SkyKick) and used the stolen app credentials to authenticate directly into customer Microsoft 365 tenants as the backup service principal. [1] The OAuth application carried broad pre-granted permissions including Directory.ReadWrite.All, enabling read and write access to mail, OneDrive and SharePoint files, and Teams chats. [2] Scripted sign-in attempts, identifiable by Python-based user agent strings and originating from a specific IP address, began as early as October 13, 2026, preceding the main wave of activity that Microsoft confirmed on October 15, according to ConnectWise's advisory. [3]

Huntress confirmed at least 162 compromised tenants within its own monitored environment. [2] That figure represents only what one security vendor could observe directly across its Managed Service Provider (MSP) customer base. The actual count across all MSPs using the service has not been disclosed, which means 162 is a lower bound, not a ceiling. In roughly 50 of the tenants Huntress tracked, the compromised service principal self-assigned Exchange Administrator directory roles. [2] In at least one tenant, persistence was established within approximately 5 minutes of initial access, including assignment of Global Administrator rights and credential additions to an MSP management tool. [2]

How the attacker got the credentials

The two accounts of how the attacker obtained the application credentials remain in direct conflict. The post's framing suggests the attacker exploited the pre-existing OAuth trust relationship. [1] Separate reporting characterizes the event as credential theft from the ConnectWise vendor environment, according to secondary analysis of the incident. [4] ConnectWise itself has not disclosed the initial access vector into its own infrastructure. [2]

That unresolved gap matters for how defenders respond. A vendor breach starting point produces one attack chain. A compromised trust relationship produces another. The root cause remains unconfirmed at time of publication.

A documented pattern, not an isolated event

Exploitation of public-facing applications is now the top initial access vector, accounting for 40% of cases tracked by a 2026 threat intelligence index, up 44% year over year. [5] The Verizon 2026 Data Breach Investigations Report independently places vulnerability exploitation at 31% of initial access vectors, up from 20% the prior year, surpassing stolen credentials for the first time. [6] Both findings point to the same structural shift: attackers have moved toward compromising application layers rather than user credentials directly. The ConnectWise attack fits that structural pattern (the target was the application trust model, not a user account protected by MFA) while using credential theft and OAuth trust abuse as its mechanism rather than direct vulnerability exploitation.

Breakout speed and the detection window

29 minutes. That is the average eCrime breakout time recorded in a 2026 adversary tracking report, with the fastest recorded breakout at 27 seconds. [7] By the time a service principal anomaly surfaces in a Security Information and Event Management (SIEM) alert queue, lateral movement in many environments is already complete.

Dwell time: the longer threat

Short breakout time coexists with extended attacker presence. A 2026 incident response analysis covering more than 500,000 hours of frontline engagements records: [8]

• A global median dwell time of 14 days
• Rising to 122 days for espionage-class actors and cases involving stealthy persistence mechanisms

A backup application service principal with Exchange Administrator rights assigned to it is exactly the kind of low-noise access path that enables extended dwell. It does not generate login failure alerts. It does not trigger MFA prompts. It looks like the backup job running on schedule.

Read together, those two datasets imply something neither source states directly: this attack class is likely underrepresented in detection telemetry. Attackers can be in and persistent before an anomaly registers, then remain invisible because the access pattern resembles legitimate application behavior. The detection gap runs deeper than timing: it is a pattern-recognition problem built into how SIEMs are tuned to flag user anomalies rather than application identity anomalies.

The same incident response analysis also documents that ransomware operators now systematically target backup infrastructure, identity services, and virtualization management planes, prioritizing recovery denial over data theft. [8] The ConnectWise Cloud Backup attack gave any actor who chose to use it for destructive purposes both access to backup data and the administrative roles needed to disable recovery capabilities. Whether any actor has done so in affected tenants remains unconfirmed. ConnectWise stated it had no indicators that backup data was compromised at time of publication. [2] The access conditions that would have permitted it existed in roughly 50 confirmed tenants for an unknown duration before containment.

Regulatory exposure

The New York Department of Financial Services (NYDFS) published an Industry Letter in October 2025 providing prescriptive guidance on managing third-party service provider risk under Part 500, Section 500.11 of its cybersecurity regulation. That guidance was already in force when the October 2026 incident occurred. NYDFS stated it will consider the absence of appropriate third-party risk management practices in its examinations, investigations, and enforcement actions. [9] The guidance explicitly frames vendor due diligence questionnaires as substantive evaluations rather than checkbox exercises. [9]

MSPs serving New York-regulated financial entities and using ConnectWise tooling are directly in scope. The guidance does not create new requirements, but NYDFS's enforcement posture means that a failure to document compensating controls for a known-compromised backup provider will be treated as a compliance deficiency. Joint cybersecurity guidance from Five Eyes agencies established the same principle in 2022: compromising an MSP gives attackers access to multiple victim networks with cascading effects, and MSP-customer contracts must clearly assign security responsibilities. [10]

Operational remediation

ConnectWise shut down Cloud Backup application access as a containment measure. [3] Disabling the application does not invalidate OAuth tokens already issued. According to secondary analysis of the incident, existing tokens remain valid until expiry even after the application is disabled, and affected tenants must take the following steps: [4]

• Actively revoke service principal credentials
• Review all application credential changes since October 13, 2026
• Audit directory role assignments made by the backup service principal
• Verify that no additional credentials were added to other applications within the tenant

According to that same secondary analysis, searching only for "ConnectWise" branding will miss tenants where the legacy "SkyKick Cloud Manager" name still appears. [4]

The structural fix

The operational remediation above addresses exposure from this specific incident. The structural problem sits at a different layer.

A backup application does not need Directory.ReadWrite.All to perform its stated function. That permission scope is a procurement and architecture decision accepted at onboarding, not a technical requirement of the application. Third-party OAuth application credential scoping should be treated as a first-order security control at provisioning time, with explicit sign-off on any permission that grants directory-wide read or write access. Supply chain attacks have increased approximately 4 times over the past 5 years, according to a 2026 threat intelligence index. [5] The attack surface is the trust model. The control point is the permission scope granted to it.

References

1. X (Twitter) / @MsftSecIntel, "Active Supply Chain Attack on ConnectWise Cloud Backup OAuth App [Post]," X (Twitter), 2026-10-15. [Online]. Available: https://twitter.com/MsftSecIntel/status/2111358888125878426 [Accessed 2026-10-17].
2. I. Ilascu, "Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack," BleepingComputer, 17-Oct-2026. [Online]. Available: https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/ [Accessed 19 Oct. 2026].
3. ConnectWise, "Latest Advisories – ConnectWise Trust Center," ConnectWise, 2024-03-21. [Online]. Available: https://www.connectwise.com/company/trust/advisories [Accessed 2025].
4. A. Bhatnagar, "Could Your Microsoft 365 Tenant Be Exposed by the ConnectWise Cloud Backup Breach?," Cloaked, 2026. [Online]. Available: https://www.cloaked.com/post/could-your-microsoft-365-tenant-be-exposed-by-the-connectwise-cloud-backup-breach [Accessed 2026-10-17].
5. IBM X-Force, "X-Force Threat Intelligence Index 2026," IBM, 2026. [Online]. Available: https://www.ibm.com/reports/threat-intelligence [Accessed 19 Oct. 2026].
6. C.D. Hylender, P. Langlois, A. Pinto, S. Widup, "2026 Data Breach Investigations Report," Verizon, 2026. [Online]. Available: https://www.verizon.com/business/resources/reports/dbir/ [Accessed 19 Oct. 2026].
7. CrowdStrike, "CrowdStrike 2026 Global Threat Report: Year of the Evasive Adversary," CrowdStrike, 2026. [Online]. Available: https://www.crowdstrike.com/en-us/global-threat-report/ [Accessed 19 Oct. 2026].
8. Mandiant / Google Threat Intelligence Group (GTIG), "Special Report: M-Trends 2026," Mandiant, 2026. [Online]. Available: https://cloud.google.com/security/resources/m-trends [Accessed 19 Oct. 2026].
9. L. Taubin, C. Kuck, "NYDFS Issues Guidance on Managing Risks Related to Third-Party Service Providers," Alston & Bird, Of Interest Financial Services Blog, October 27, 2025. [Online]. Available: https://www.alstonconsumerfinance.com/nydfs-issues-guidance-on-managing-risks-related-to-third-party-service-providers/ [Accessed 2025].
10. Cybersecurity and Infrastructure Security Agency (CISA), "Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A)," Cybersecurity and Infrastructure Security Agency (CISA), 2022. [Online]. Available: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131a [Accessed 2025].

How Anomali Can Help

The ConnectWise supply-chain attack exploited OAuth trust gaps that MFA cannot block, requiring unified telemetry, threat intelligence, and agentic detection to catch.

• Anomali's Unified Security Data Lake normalises telemetry across cloud, endpoint, network, and identity, providing the correlated visibility needed to detect the attack patterns described in this article without vendor lock-in.
• Anomali's Agentic SOC Platform brings together threat intelligence, security data, and AI-guided investigation into a single interface, helping analysts triage, investigate, and respond to threats of the type described above without context-switching across tools.
• Anomali ThreatStream provides access to 200+ specialised threat intelligence feeds, mapping the IOCs, TTPs, and threat actor infrastructure described above directly to your security operations.

Can your current stack detect OAuth abuse from supply-chain compromises like the ConnectWise attack?

Talk to Anomali.

‍