Microsoft SharePoint attacks ensnare 400 victims, including federal agencies

The report describes a multi-wave, in-the-wild exploitation campaign abusing Microsoft SharePoint zero-days (CVE-2025-53770/53771 and related flaws) that has compromised more than 400 organizations — including U.S. federal agencies and critical infrastructure — with attackers using the 'ToolShell' exploit chain to bypass MFA/SSO, deploy Warlock ransomware, and attempt cryptographic key theft; Microsoft released urgent patches and CISA initiated a national coordinated response.