[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGdetGv8MfME7QtjiUsrEHpCGdzeRK3SN9nj8K2_HbOo":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"5c3ebc0f-e439-495c-8996-be04a5403735","New Helix vishing group emerges in SharePoint data theft attacks","new-helix-vishing-group-emerges-in-sharepoint-data-theft-attacks-d7c8b8","A new data-extortion group called Helix is using identity-focused tactics such as voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to steal data from SharePoint environments. [...]","A new data-extortion group named Helix is targeting organizations by using identity-focused tactics like vishing, device code phishing, and MFA abuse to gain access to SharePoint environments. After gaining access, they register new MFA apps for persistence, then exfiltrate files, which are then used for extortion or sold to other cybercriminals. Researchers believe Helix may have emerged from or shares infrastructure with previous groups like ShinyHunters and BlackFile.","New Helix group uses vishing and MFA abuse to steal SharePoint data for extortion.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-helix-vishing-group-emerges-in-sharepoint-data-theft-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F09\u002Fhelix.jpg","2026-07-09T17:08:29+00:00","2026-07-09T18:00:26.838647+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"Helix","threat_actor",{"name":21,"type":19},"ShinyHunters",{"name":23,"type":19},"BlackFile",{"name":25,"type":26},"SharePoint","product",{"name":28,"type":29},"MFA","technology",{"name":31,"type":29},"vishing","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56],{"type":57,"value":58,"context":59},"ip","179.43.185.230","IP address used for automated enumeration and collection of SharePoint data.",[25],{"controls":62,"vendors":144},[63,92,118],{"slug":64,"name":65,"problem":66,"products":67},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":93,"name":94,"problem":95,"products":96},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[97,102,110],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":98,"product_name":99,"url":100,"description":101},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":119,"name":120,"problem":121,"products":122},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":140,"product_name":141,"url":142,"description":143},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",[145,148],{"slug":69,"name":70,"logo_path":71,"roles":146},[147],"affected",{"slug":149,"name":150,"logo_path":151,"roles":152},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":173},"helix-group-exploits-vishing-and-mfa-abuse-to-steal-sharepoint-data","Helix Group Exploits Vishing and MFA Abuse to Steal SharePoint Data","The Helix group demonstrates how social engineering tactics like voice phishing (vishing) and device code phishing can bypass technical controls entirely by targeting the human element and identity layer. Once inside, attackers register rogue MFA devices to establish persistence, making detection and eviction significantly harder. This matters because stolen SharePoint data often contains sensitive business documents, credentials, and PII that can be leveraged for extortion or sold on criminal marketplaces. The attack chain highlights that even organizations with MFA enabled are vulnerable if MFA registration and conditional access policies are not tightly governed.",[159,160,161,162,163,164,165,166,167,168,169,170,171,172],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-63B: Digital Identity Guidelines (Authenticator Assurance Levels)","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST IA-5: Authenticator Management","NIST SI-4: System Monitoring","MITRE ATT&CK T1621: Multi-Factor Authentication Request Generation","MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1048: Exfiltration Over Alternative Protocol","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach",{}]