This is a pop-up episode and not our normal format: no debate, no Silas. We set aside the episode we had planned because the facts are moving and MSPs and business owners need them this week. Everything is as of Tuesday, October 20, 2026, and every claim is attributed.
Vivian walks through what Huntress, Microsoft and ConnectWise have said about the sign-ins into customers’ Microsoft 365 tenants, and what no one has confirmed yet. Daniel gives the three details that matter more than the vendor name, and four checks to run before the week is out.
In this episode
- What Huntress, Microsoft and ConnectWise have reported so far, with dates, and which numbers have already moved
- Why no multifactor prompt ever appeared: the application signed in with its own credential, and no user was involved
- What is not known: how the credential was obtained, who is behind it, and the true number of affected tenants
- Four checks: application sign-ins for Cloud Backup, disable (don’t delete) the ConnectWise applications, review secrets and certificates added since October 13, and audit-log self-role-assignment
- The bigger point: every vendor application with standing permissions in a client tenant is a credential you do not control
About the show
All Eyes takes one question the industry is arguing about, puts two people who genuinely disagree in a room, and does not let either off easy. Hosted by Vivian Calloway, with Daniel Ramos and Silas Wray, who argues the other side for a living. New episodes most Tuesdays.
🔊 This podcast uses AI-generated voices. Every voice you hear is AI-generated, including the host. Daniel Ramos's voice is his own, cloned with his written consent. We disclose this at the start and end of every episode. Read exactly how we use AI →
Sources cited on air
- Huntress — ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks (Oct 16, 2026; updated Oct 17 and Oct 19)
- BleepingComputer — Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
- Cybersecurity Dive — ConnectWise suspends Cloud Backup as hacker targets Microsoft 365 users (Oct 19, 2026), including Microsoft Threat Intelligence’s statement
- iTnews — coverage of the stolen Cloud Backup credential