22/07/2025
A serious security weakness was recently found in Microsoft SharePoint, a tool many companies use to share and manage documents. Hackers started using this weakness as early as July 7, 2025, according to a cybersecurity company called Check Point Research.
The first attacks were aimed at a big Western government, but soon spread to other government offices, phone companies, and software companies in North America and Western Europe.
The attacks came from three different internet addresses, including one that was also used before to attack another company’s software.
What makes this threat dangerous?
This problem is called a zero-day vulnerability, which means it was unknown and unpatched when hackers first found it — giving them a head start to break in before anyone could fix it.
Experts at Check Point say they have already seen dozens of hacking attempts, and they are warning all companies to update their security systems immediately, because these attacks are advanced and spreading fast.
How are hackers breaking in?
They’re taking advantage of two specific security holes in SharePoint:
One lets them run harmful code on the server without permission.
The other lets them pretend to be someone they’re not, to get higher access inside the system.
Some of these holes were fixed by Microsoft earlier this month, but hackers found ways around the original fixes — so new patches were released. Unfortunately, some hackers still found ways to use the flaws before companies updated their systems.
How does the attack work?
Hackers sneak harmful files onto the company’s SharePoint server.
These files steal secret security keys that the server uses to check if people are really allowed to log in.
Once hackers have these keys, they can make fake logins and keep coming back anytime they want.
In some cases, hackers don’t even leave files behind — they run their code directly in memory, making it much harder to detect.
Who is being targeted?
These attacks have happened in the U.S., Canada, Europe, the Middle East, and Africa, hitting governments, phone companies, factories, big engineering firms, and other critical businesses.
Who is behind it?
While no one knows for sure, Google’s Mandiant team believes at least one group is linked to China.
What should companies do?
Update SharePoint immediately with the latest fixes.
Change security keys to block any stolen ones.
Restart servers so hackers can’t keep using their hidden backdoors.
In short: A dangerous new hack is targeting companies through SharePoint. If you use SharePoint, update and secure your systems now to protect your company’s sensitive information.
