Microsoft 365 Accounts Hijacked via ConnectWise Vulnerability
Attackers are exploiting a ConnectWise ScreenConnect flaw to gain access to managed service providers and pivot into Microsoft 365 tenants.
Security researchers at Huntress have documented active exploitation of a patched but widely unupdated ConnectWise ScreenConnect vulnerability being used to compromise managed service providers and then pivot into their customers' Microsoft 365 environments.
The attack chain begins with the ConnectWise flaw, which gives attackers remote access to MSP management consoles. From there, they harvest Microsoft 365 OAuth tokens and gain persistent access to customer tenants without triggering MFA.
Affected MSPs and their clients should immediately update ConnectWise ScreenConnect, audit OAuth app permissions in their Microsoft 365 tenants, and review sign-in logs for anomalous access.