DAILY BRIEFING
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
Today's briefing covers ConnectWise suspending app identities after M365 tenant compromises and a malicious npm package delivering shellcode loaders.
5 stories2 min read
Threat actors compromised ConnectWise Cloud Backup credentials to access at least 173 Microsoft 365 customer tenants, prompting ConnectWise to disable seven application identities and suspend its Cloud Backup service.
In software supply chain risks, researchers discovered a malicious npm package named imgdecode linked to the MALFEX campaign, which loads a native DLL to fetch and execute shellcode on Windows systems.
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Threat actors exploited a compromised ConnectWise Cloud Backup credential to achieve unauthorized sign-ins across 173 Microsoft 365 partner and customer tenants. The app holds broad permissions across mailboxes, SharePoint, OneDrive, and directory data.
- Why it matters
- Managed service providers and their clients using ConnectWise Cloud Backup face widespread unauthorized access to tenant data across Microsoft 365 services.
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
ConnectWise suspended its Cloud Backup service and disabled seven application identities after threat actors obtained unauthorized access to the identities, leading to compromised Microsoft 365 tenants.
- Why it matters
- Organizations relying on ConnectWise Cloud Management and Backup solutions face potential exposure of their Microsoft 365 tenant data to unauthorized threat actors.
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
A malicious npm package named 'imgdecode', part of the MALFEX campaign, was found hiding a Windows DLL within a Node.js addon. When called on Windows, the DLL downloads encrypted shellcode from GitHub and injects it into dllhost.exe.
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
The requested article content could not be retrieved due to a Cloudflare security verification block on the source website.
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.
Key takeaways
- ConnectWise disabled seven application identities on October 17, 2026, to halt unauthorized access across Microsoft 365 tenants.
- Attackers used compromised ConnectWise credentials to breach at least 173 partner and customer Microsoft 365 environments.
- The malicious npm package imgdecode loads a Windows DLL that fetches and injects decrypted shellcode into dllhost.exe.