ConnectWise Cloud Backup Credential Compromise Exposes Microsoft 365 Tenants
China-linked threat actor Storm-0940 abused stolen ConnectWise Cloud Backup application credentials to authenticate into Microsoft 365 tenants via non-interactive Microsoft Graph token issuance. The compromised service principal held broad permissions across Exchange Online, OneDrive, SharePoint, and Teams, enabling MFA and conditional access bypass. Attackers leveraged the ARTEX agentic AI framework to conduct approximately 2,900 sign-in attempts per minute, targeting over 2,250 tenants with confirmed access in 173. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management and disabled seven application identities.
Microsoft 365 Multi-Vendor Social Engineering Vulnerability Rollup
Microsoft's October 2026 Patch Tuesday addressed 1,413 vulnerabilities, including over 670 privilege escalation and 300 remote code execution flaws. A critical zero-day vulnerability was actively exploited via social engineering-driven credential theft. Attackers chained compromised Active Directory tokens with Windows kernel vulnerabilities (CVE-2026-XXXXX) and Office macro engine flaws (CVE-2026-YYYYY) to achieve SYSTEM-level access and facilitate ransomware deployment. The update also remediates SharePoint Server deserialization issues and SQL Server stored procedure elevation of privilege. Organizations must prioritize patching Windows and Office and implement strict MFA and conditional access policies to interrupt these multi-stage attack chains.