Security Report – 23 Oct 2026

cloud environment

23 Oct Security Report – 23 Oct 2026

Posted at 14:43h in Security Breach, TCT News by

Microsoft 365 has become the cloud environment at the heart of modern business. For many organisations, it is where email, files, collaboration and meetings come together, and where much of the day-to-day work gets done.

At the same time, rising infrastructure and storage costs are accelerating the move from traditional on-premises environments to Azure and other Microsoft cloud services. As organisations become more deeply integrated into the Microsoft ecosystem, they are also creating an increasingly complex cloud environment spanning users, identities, devices, applications, infrastructure and data.

This consolidation delivers significant business value, but it can also increase security complexity. Maintaining consistent policies, visibility and control across a growing cloud environment requires ongoing management and oversight.

Microsoft provides a strong security foundation, but security, configuration, data protection and recoverability remain shared responsibilities. Achieving true cyber resilience means going beyond individual security controls and establishing centralised visibility, consistent security configuration, stronger identity protection, continuous monitoring and an independent recovery strategy that ensures critical business data and services can be restored when needed.

 

Recent Breaches

United States – ConnectWise –Technology

Exploit: Supply Chain Attack

Risk to Business: Moderate: ConnectWise shut down customer access to its Cloud Backup service, formerly known as SkyKick Cloud Backup, after hackers accessed application identities and compromised Microsoft 365 tenants. The company said it recently identified unauthorised access to application identities within the ConnectWise Cloud Backup environment and shut down application access for its partners and clients. Reports of malicious activity began emerging on Friday, October 16, with administrators observing unauthorised access to client data in Microsoft 365 tenants. Microsoft also confirmed the activity, reporting unauthorised authentication attempts from an IP address on October 15. Following the incident, ConnectWise said scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable. The company has also temporarily taken SaaS Security and Cloud Management offline while it completes its review of the incident.

United States –GitHub – Technology 

Exploit: Supply Chain Attack

Risk to Business: Moderate: The credential-theft campaign GhostAction has recently ramped up, targeting more than 30,000 GitHub repositories across 3,000 users and organisations. GhostAction is a supply chain attack campaign targeting developer infrastructure on GitHub. First discovered in September 2025, it involves threat actors compromising legitimate developer accounts to inject malicious GitHub Actions automation workflows into software repositories. Between August 31 and September 30, 2026, the campaign affected 772 public GitHub repositories, targeting 2,577 secrets. It then accelerated sharply, with a major spike between October 8 and 9 that affected more than 30,000 repositories across 3,000 users and organisations. Campaigns targeting repositories on Microsoft-owned GitHub are growing in number. A recent automated malicious campaign dubbed Megalodon affected more than 5,000 GitHub repositories. These campaigns aim to steal continuous integration and continuous deployment (CI/CD) secrets, cloud credentials, package registry tokens for platforms such as npm, PyPI and Docker Hub, and AI provider API keys.

Talk to a TCT team member today about automation for your business.