SharePoint under fire: ToolShell attacks hit organizations worldwide

ESET researchers disclosed active exploitation of two zero‑day SharePoint vulnerabilities (CVE‑2025‑53770 and CVE‑2025‑53771), called ToolShell; the flaws are being used by cybercriminals and APT groups in global attacks, with the United States comprising about 13.3% of observed incidents, and readers are referred to ESET's blogpost and video for full technical details.