Microsoft SharePoint bug exposes banks, governments to global hit

Good morning. Here's what happened overnight and what you need to know today.

---

1.

Access granted: A sweeping cyber espionage operation exploiting a zero-day vulnerability in Microsoft’s on-premises SharePoint server software has compromised about 100 different organisations, including government bodies in the US and Germany, according to media reports citing Eye Security and the Shadowserver Foundation. Universities, energy companies and an Asian telecommunications company were also targeted, The Washington Post reported. The attacks began on 18 July and were still active when Microsoft issued patches over the weekend. SharePoint is used by businesses and government agencies for internal document management, data organisation and collaboration. According to the US Cybersecurity and Infrastructure Security Agency, the vulnerability provides unauthenticated access to systems and the ability to execute code, while Palo Alto Networks said the hack likely involves exfiltrating sensitive data, deploying persistent backdoors and stealing cryptographic keys. Microsoft released security updates for SharePoint Server 2019 and the Subscription Edition, but the 2016 version remains unpatched. Researchers warn the pool of targets includes industrial firms, banks, healthcare companies and government entities. (Reuters)(Bloomberg)(CNBC)(AP)(WaPo)

2.

Powell(ful) pressure: US Treasury Secretary Scott Bessent called for an inquiry into “the entire Federal Reserve institution”, while a Trump ally has referred Chair Jerome Powell for a criminal investigation by the DOJ, as the campaign against the central bank boss intensifies. Speaking on CNBC, Bessent questioned whether the Fed has “been successful” and accused the central bank of “fear-mongering over tariffs”. Republican Representative Anna Paulina Luna referred Powell to the Department of Justice for allegedly lying under oath. Bessent’s comments come amid a report from The Wall Street Journal that he has been so far successful in convincing Trump not to fire Powell despite his frustrations about the Fed not cutting interest rates. Powell cannot be fired unless a specific legal cause is established, which according to the Journal, Bessent has stressed would likely face major political, legal and market repercussions. Trump last week said it was “highly unlikely” he will fire Powell unless he “needs to leave for fraud”. The administration and Trump allies are nonetheless using the Fed’s USD2.5 billion headquarters renovation, which is reportedly about USD700 million over budget, to ramp up criticism. In response, the Fed has released information about the renovation, including a FAQ and a video tour of the project, with challenges encountered such as asbestos abatement and preservation of historical details. (Capital Brief)(Anna Paulina Luna)(Fed)(WSJ)(FT)(CNBC)

3.

Iced out: The property industry has not featured much on the invitation list for Treasurer Jim Chalmers' upcoming economic reform summit. But developers and their lobby groups are still set to be involved in talks with the government in the lead-up to the event amid fears the sector's productivity is languishing and Labor's target for 1.2 million new homes to be built by 2029 will not be met. Property lobby groups and CEOs did not feature prominently in the two rounds of invites sent out by Chalmers ahead of the event in August. There was one exception: Sue Lloyd-Hurwitz, chair of the National Housing Supply and Affordability Council and a former CEO of Mirvac. But a source close to the government granted anonymity to discuss confidential matters said a housing roundtable would be convening in early August, organised by Housing Minister Clare O’Neil’s office. (Capital Brief)

4.

Market march: The S&P 500 hit new record highs on Monday, lifted by Alphabet and other megacaps ahead of key earnings reports, while investors bet on potential US trade deals to offset economic damage from tariffs. Alphabet rallied ahead of its Wednesday results, Verizon shares rose after raising its annual profit forecast, and Jack Dorsey's Block surged as it is set to join the S&P 500. Of companies reporting so far, 83% have posted higher-than-expected earnings per share, according to FactSet. Stellantis reported a surprise €2.3 billion first-half net loss, citing a €300 million hit from Donald Trump’s tariffs and €3.3 billion in pre-tax charges. Meanwhile, OpenAI signed a strategic partnership with the UK to explore AI infrastructure investment and adoption in public services.(WSJ)(FT)(Bloomberg)(Reuters)

5.

Trump treasury: Trump Media & Technology Group (TMTG) built up a USD2 billion ($3.1 billion) stake in bitcoin and bitcoin-related securities as part of its bitcoin treasury strategy. TMTG said on Monday that its holdings now comprise around two-thirds of Trump Media's approximately USD3 billion in liquid assets. TMTG said that around USD300 million in capital was allocated to an options acquisition strategy for bitcoin-related securities. The news comes after Trump signed the GENIUS Act into law late on Friday, marking a huge win for the crypto industry and prompting a jump in crypto-linked companies. Earlier this year, TMTG began emulating the crypto treasury play pioneered by Michael Saylor’s company, Strategy, which now owns more than 3% of all the bitcoin ever minted. Bitcoin climbed 0.4% on Monday, though it remains more than 3% away from its all-time high of USD123,153 hit early last week. Ether was last trading at USD3,795.4. (TMTG)(Bloomberg)(Capital Brief)

6.

Gaza incursion: Israeli ground troops pushed into Deir al-Balah for the first time, striking Gaza’s main hub for humanitarian efforts and one of the last areas not previously hit by major ground operations. According to media reports, airstrikes accompanied the incursion, which followed evacuation orders via pamphlets dropped at dawn. Gaza health officials said at least 18 people, including three women and five children, were killed in Israeli strikes overnight and into Monday. Israeli sources have told media the army had previously avoided Deir al-Balah because they suspect Hamas might be holding hostages there. It comes after the UN food agency over the weekend accused Israeli forces of firing on a crowd seeking humanitarian aid. According to the UN humanitarian coordinator, 87.8% of Gaza is now under evacuation orders or inside Israeli military zones.(BBC)(Euro News)(AP)(Time)

7.

Le denial: Elon Musk’s X denied claims made by French authorities that the social media platform manipulated its algorithm and engaged in “fraudulent” data extraction, after the French government launched a criminal investigation into the company. X’s global government affairs “categorically” denied the claims on Monday, adding that the probe is designed to “restrict free speech”, undermines X’s right to due process and threatens its users’ rights to privacy. Earlier this month, French prosecutors said they were investigating whether X had engaged in “tampering with the functioning of an automated data processing system” or the “fraudulent extraction of data”. X said that it is in the dark about the specific allegations being made against it and that it has not acceded to authorities’ demands. Meanwhile, X, Meta and LinkedIn are appealing an unprecedented VAT claim by Italy that could influence tax policy across the EU, Reuters reports. (X Global Government Affairs)(FT)(CNBC)(Capital Brief)

8.

Pay the Piper: The EU will make the UK pay a percentage of the value of any weapons bought from UK companies through a Brussels-led defence fund, the FT reports, citing EU diplomats. In May, UK PM Keir Starmer said the UK would join the EU’s new €150 billion ($268.9 billion) Security Action for Europe (Safe) project to boost military spending across the continent, as part of a “reset” of bilateral relations, but the exact amount the UK will have to pay remains under discussion. London must compensate Brussels for being allowed to take part in the EU-backed scheme aimed at procuring drones, missile defence systems and other capabilities, two EU diplomats told the masthead. Safe is part of the bloc’s effort to mobilise €800 billion worth of defence spending by 2030 to counter a growing Russian threat and address calls by Trump for the EU to increase its own security spending. (FT)(Capital Brief)