A threat actor is targeting authentication credentials stored in Commvault's cloud-based backup and recovery platform and using them to gain unauthorized access to customers' Microsoft 365 accounts.