Attackers stole ConnectWise app credentials and used AI agents to try more than 2,250 Microsoft 365 tenants. Audit your connected apps

The attackers did not need anyone's password. They used an app the customers had already trusted.

What happened

Microsoft says Storm-0940, a China state aligned actor, gained access to ConnectWise's Cloud Backup service and took over the identities of several ConnectWise cloud applications. Using ARTEX, an open source AI agent framework, the group then attempted to sign in to more than 2,250 Microsoft 365 tenants through those already authorized apps, without any interactive user sign-in.

In some environments the agents went further: reconnaissance through Microsoft Graph, changes to application credentials to keep access, and changes to identities, groups and privileged roles. Microsoft warns that added app credentials can stay active as a backdoor even after the original app is fixed, and that a successful sign-in does not by itself prove data was taken. TechCrunch reports ConnectWise paused access to the backup service while it investigated.

Microsoft's guidance includes reviewing every tenant where the apps were ever authorized, searching by application ID rather than display name, reviewing service principal sign-ins, and checking audit logs for credential additions, consent grants and role changes.

My take

Every automation platform connection is the same shape as that backup app. When a client clicks Allow for Zapier, Make, n8n or a CRM sync in Microsoft 365 or Google Workspace, they create an app identity that can read mail or files with no user present. Most small businesses never look at that list again.

Three habits I would build into every client setup:

1. Keep an inventory of connected apps per tenant, with the scopes each one holds and who approved it.
2. Ask for the narrowest scopes the workflow needs. A tool that only sends invoices should not read every mailbox.
3. Remove connections for retired workflows. Microsoft specifically says to check tenants where an integration is no longer in use.

Machine speed attacks leave little time to react, so the preparation has to happen before the alert.

I design and build automations with this in mind: lead routing, reporting, data entry and agent workflows that run on scoped connections you can actually audit. See romielwillautomate.dev.