A newly identified extortion group called Helix is tricking employees into giving attackers access to Microsoft 365 accounts, then stealing files from SharePoint to extort victim organizations. ReliaQuest says the group uses voice phishing (phone calls pretending to be a manager), device-code phishing to capture account access, and multi-factor authentication abuse by enrolling a rogue authenticator app for persistence. After access, Helix enumerates SharePoint content and bulk-downloads files, with infrastructure and tradecraft suggesting possible overlap with the now-defunct BlackFile group and similarities to ShinyHunters campaigns.
Why it matters: Organizations using Microsoft 365 and SharePoint should treat this as an active account-takeover and data-theft threat, especially if staff can be reached by phone or Teams and device-code login flows are enabled. The concrete action is to disable device-code authentication where possible, restrict SharePoint access to managed devices, harden MFA enrollment, and warn employees about calls claiming to be managers or IT staff.
Bill Toulas
2026.07.09
100% relevant
This article establishes Helix as a distinct named data-extortion actor with a defined intrusion pattern centered on vishing-led Microsoft 365 compromise and SharePoint data theft, rather than merely updating one victim-specific breach.
← Back to all stories