Microsoft says stolen ConnectWise application credentials were used to attempt access to more than 2,250 Microsoft 365 tenants. Because the access ran as an application, no MFA prompt ever appeared.
In a report published on 21 October 2026, Microsoft disclosed that attackers used stolen third-party application credentials to attempt unauthorised access to more than 2,250 Microsoft 365 tenants. The entry point was neither a Windows flaw nor a weak password: it was application permissions granted to a management vendor years ago and never reviewed again.
What happened
The chain began with a security incident disclosed around 19 October by ConnectWise, a vendor of IT management software. It reported unauthorised access to application identities and temporarily shut down its Cloud Backup, SaaS Security and Cloud Management services. With those credentials, the attackers connected straight into customer Microsoft 365 environments using permissions those customers had already approved.
The important detail is that this connection is made on behalf of an application, not a user: no password is typed and no multi-factor authentication prompt appears. Corporate MFA policy kept working as designed while the access happened entirely outside it.
Microsoft attributes the activity to Storm-0940, an espionage group it has tracked since at least 2021, and says it used ARTEX, a public penetration-testing framework written in Go that coordinates several automated agents. In some cases the attackers moved from target selection to privileged cloud access in under three hours.
An independent analysis published by Huntress on 26 October puts numbers on that tempo: one automated sweep processed roughly 1,000 tenants, with bursts of around a hundred failed token requests inside ten seconds. Huntress adds that its findings match Microsoft's account but do not alone prove AI involvement.
Why it matters
The incident exposes a gap between where security budgets look and where the risk sits. Organisations harden the firewall, the endpoint and MFA, yet third-party applications consented to inside the cloud tenant are rarely audited at all. A "read all mail" permission granted once for an accounting add-in or a backup tool becomes a direct attack surface the moment that vendor is breached.
Microsoft states that most attempts failed, but that the attackers still established persistent, privileged access at numerous organisations. Nor is it enough for the vendor to sever the connection: an attacker already inside can remain there using credentials they created themselves.
What this means for businesses in Türkiye
A large share of companies in Türkiye running Microsoft 365 do not administer the tenant themselves; it is managed through an IT service provider, a software vendor or an accounting firm. In that model every integration is a separate door onto company data, and in most organisations nobody has ever produced the list of those doors.
The regulatory picture is equally clear. Under Türkiye's Law No. 6698 the company itself remains the data controller, whoever's infrastructure processes the data. If a vendor compromise exposes corporate mail and files, the company's own notification and security obligations are triggered.
What we recommend at Kamer Bilişim
- Build a third-party application inventory. Open the Enterprise Applications list in the Microsoft 365 admin centre and record which permissions each application holds and when it was last used. Revoke consent for anything you do not recognise or no longer use.
- Disable user consent and move to admin consent. Stop end users granting data permissions on their own. Route new integrations through a review step owned by IT, and scope each permission as narrowly as the application allows rather than to the whole mailbox.
- Monitor application identities, not just users. MFA and conditional access cover interactive user sign-ins only. Alert on service principal sign-ins, new client secrets or certificates, and role assignment changes. In this campaign the earliest warning signs appeared in exactly those logs.
If you cannot say which third-party applications hold which permissions in your Microsoft 365 tenant, a permissions audit is the fastest available win. We run that audit on site across the Anatolian side of Istanbul and remotely elsewhere; reach us through our contact page.
Source: The Register, with Microsoft Threat Intelligence and Huntress reports
Source: The Register