Attackers used a compromised ConnectWise Cloud Backup (SkyKick) app credential to authenticate as the tenant service principal and mint Microsoft Graph tokens, bypassing MFA/user controls. Observed across multiple tenants from 144.172.64[.]128 targeting app IDs 506e08f9-6e9a-4da4-942b-a099a03644ae and 24205314-2b89-4e07-a2a4-579e898a5640, enabling mail/OneDrive/SharePoint/Teams access and role/secret changes. Disable/revoke app consent and audit Service principal sign-ins to mitigate.