New Helix vishing group emerges in SharePoint data theft attacks
New Helix group uses vishing and MFA abuse to steal SharePoint data for extortion.
A new data-extortion group named Helix is targeting organizations by using identity-focused tactics like vishing, device code phishing, and MFA abuse to gain access to SharePoint environments. After gaining access, they register new MFA apps for persistence, then exfiltrate files, which are then used for extortion or sold to other cybercriminals. Researchers believe Helix may have emerged from or shares infrastructure with previous groups like ShinyHunters and BlackFile.
AI summary of the linked source. Not reviewed by an editor. How this works
Run SharePoint?
Get an email when a new story names SharePoint, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Helix group demonstrates how social engineering tactics like voice phishing (vishing) and device code phishing can bypass technical controls entirely by targeting the human element and identity layer. Once inside, attackers register rogue MFA devices to establish persistence, making detection and eviction significantly harder. This matters because stolen SharePoint data often contains sensitive business documents, credentials, and PII that can be leveraged for extortion or sold on criminal marketplaces. The attack chain highlights that even organizations with MFA enabled are vulnerable if MFA registration and conditional access policies are not tightly governed.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 179.43.185.230