ConnectWise credential theft exposes tenants and interrupts restores

Independent

As reported on 18 October, ConnectWise disabled Cloud Backup and revoked a stolen credential following unauthorised access. Huntress confirmed unauthorised sign-ins in 162 Microsoft 365 tenants and found almost 1,000 with activity from the attacker's address.

Why it matters: The application's permissions allowed the credential to reach live customer environments across consenting tenants. Huntress reported that a second ConnectWise app added credentials to two other apps at one tenant, providing a potential return path after the original credential's revocation. MSPs and customers also lost restore access while Cloud Backup was offline.

Decision: For affected administrators, revoking the original credential alone is insufficient grounds to close the investigation: Huntress advised disabling, rather than deleting, ConnectWise apps and checking every app for credentials added since 13 October.

What remains uncertain: Huntress said it found and removed the rogue credential. Address-linked activity does not establish compromise of every identified tenant. ConnectWise reported no evidence of stored-backup access but could not determine individual tenant access. The theft method was unexplained; the supplied report does not establish service status on 19 October.

Read: Reported article: Stolen ConnectWise 'SkyKick' credential exposed Microsoft 365 tenants - iTnews

No linked primary source could be read; claims rely on the reporting above.

Spyware-linked advertising reaches sensitive Australian networks

Independent

Citizen Lab's investigation, as reported by iTnews, identified Discover-Tech advertising impressions on Australian government, research, electricity and media networks. Citizen Lab also linked its ads to spyware delivery to at least 45 Al Jazeera devices in 2024 and 2025.

Why it matters: The reported mechanism combines auction disclosures of device and network information with displayed ads contacting Discover-Tech servers, which could return further code for selected targets. Sensitive organisations therefore face profiling exposure as well as a potential infection route without clicks. Browser ad blocking does not cover ads inside mobile apps, which accounted for approximately 76.7 percent of Discover-Tech's bids.

Decision: For sensitive-device protection, assess whether advertising controls extend to mobile applications; browser coverage alone does not address the reported delivery channels.

What remains uncertain: Australian impressions do not establish targeting or infection. ANSTO reported no identified impact, and Australia was absent from Confiant's observed nine-country set of Candiru handoffs. Citizen Lab's data covered only part of the activity over a limited period. Google and IAB Europe had cut ties with Discover-Tech. Only the complete news article was supplied, not the underlying research reports.

Read: Reported article: Australian gov, media networks reached by Israeli firm's spy ads - iTnews

No linked primary source could be read; claims rely on the reporting above.

Compromised Shopify extensions redirect shoppers to fake checkouts

Independent

Logbase said unauthorised access to an internal Selleasy tool enabled malicious scripts in merchant settings on 13 October. HulkApps disclosed a similar extension compromise. The supplied report, updated 17 October, described Australian retailer WAGD remaining closed on Shopify's advice after a shopper encountered a fake checkout.

Why it matters: Developer Roman Zipp found HulkApps-delivered code that intercepted checkout clicks and redirected shoppers to lookalike payment pages. This creates potential customer-information exposure outside merchant systems. At WAGD, the owner reported that code removal and Shopify's verification had not ended advice to suspend trading, extending business interruption beyond reported technical remediation.

Decision: For WAGD's reopening decision, reconcile Shopify's continuing closure advice with the reported removal confirmation; removal alone had not resolved the platform's advice in this case.

What remains uncertain: The report does not establish WAGD's status on 19 October. Affected-store counts and information submitted by shoppers were unknown; WAGD's owner had not calculated losses. Logbase said some browsers blocked redirection. Zipp found the HulkApps script fired only once per browser session. Similar disclosures do not establish a common attacker.

Read: Reported article: Shopify tells Australian store to stay shut after hijacked extensions divert shoppers - iTnews

No linked primary source could be read; claims rely on the reporting above.