- Who it helps
- Security teams responsible for Microsoft 365 and third-party application access.
- Availability
- The public incident report contains investigation findings and defensive guidance. This is an incident analysis, not a software recommendation.
Attempted access and confirmed activity differ
Microsoft reports attempted sign-ins across more than 2,250 tenants after the ConnectWise incident. That figure is not a count of compromised tenants. A separate password-spray sample recorded more than 151,000 failed logins with no observed successful authentication.
Microsoft reports AI-assisted abuse of cloud application access ↗
Why application permissions matter
The report describes follow-on changes in some customer environments using stolen application credentials. Existing trusted connections can therefore affect the speed and reach of an intrusion. Microsoft distinguishes a sign-in from evidence of unauthorized data access.
Microsoft reports AI-assisted abuse of cloud application access ↗
What you can do
- Consult the current Microsoft and affected-vendor advisories for investigation guidance. Open reference ↗
Where the evidence stops
These findings are Microsoft’s telemetry-based account. The full population of affected organizations is not independently established here. No exploit, artifact or incident-response procedure was executed.
Sources read. Primary sources read November 2, 2026 UTC. No third-party software, model inference or complete workflow executed.
Sources & further reading
Web · paper
Microsoft reports AI-assisted abuse of cloud application access ↗
Identifies the subject, documented capability or specific verification limit.
Microsoft Threat Intelligence · page checked 2026-11-02
Coverage note: Independent attention and end-to-end execution remain unverified.
The record over time (1)
Dated source checks and published explanations. An observation date can differ from the original release date.
- · Added to Current
Microsoft’s October 21 report describes Storm-0940 using the ARTEX agent framework to accelerate attacks involving compromised cloud application credentials.