Applies to any organisation that has used SkyKick

Huntress found that vendor credentials linked to ConnectWise’s SkyKick (a tool commonly used for Microsoft 365 migrations and backup) are being abused to access Microsoft 365 tenants.

What to do

If SkyKick was ever connected to your Microsoft 365, even just for a one-off migration:

• disable or remove the SkyKick apps in Microsoft Entra
• review your sign-in logs for anything unexpected

We’ve already checked all our Huntress managed clients and found no issues.

If you’re not sure whether SkyKick was ever used in your organisation, get in touch and we’ll check.

Source: Huntress (SkyKick vendor credentials).