# Helix: The Emerging Data-Extortion Group Exploiting SharePoint Through Social Engineering
A newly identified data-extortion group called Helix is orchestrating sophisticated attacks against organizations by combining voice phishing, device code authentication abuse, and MFA bypass techniques to breach and exfiltrate sensitive data from Microsoft SharePoint environments. According to cybersecurity researchers at ReliaQuest, Helix has emerged as a significant threat to enterprises relying on Microsoft 365, employing social engineering tactics that target the human element of security infrastructure rather than technical vulnerabilities alone.
The group's modus operandi centers on identity-based attacks that begin with carefully crafted phone calls, progress through credential harvesting, and culminate in mass data theft and extortion demands. Recent victims include Medtronic, Nissan, the National Association of Insurance Commissioners (NAIC), Kodak, Infinite Campus, and Nottingham University—organizations spanning healthcare, automotive, insurance, education, and manufacturing sectors.
## The Threat: Attack Chain and Social Engineering
Helix's attack methodology follows a distinctive four-stage process:
Stage 1: Vishing and Impersonation
The initial compromise begins with voice phishing attacks targeting corporate employees. In several documented cases, threat actors called victims while impersonating their direct manager or other trusted authority figures. The attackers utilized two primary techniques to enhance credibility:
The psychological manipulation proves highly effective, exploiting the trust employees place in management directives and the natural hesitation to question authority figures, particularly when presented with what appears to be a legitimate company phone number.
Stage 2: Device Code Phishing
Once the initial trust is established, the attacker redirects the conversation toward technical pretext. Victims are prompted to complete what appears to be a routine IT verification process, authentication update, or system requirement. The attacker then directs the target to enter a "device code" into a Microsoft authentication portal, typically claiming this is necessary for:
Victims are directed to visit a legitimate Microsoft authentication URL where they unknowingly approve device code registration on behalf of the attacker, granting remote access to their account without ever directly sharing a password.
Stage 3: MFA Evasion Through Authenticator Registration
Upon gaining account access, Helix operators immediately register a new multi-factor authentication (MFA) app under their control—typically the Microsoft Authenticator application. This action provides persistent access that circumvents password resets and allows the attacker to approve future authentication prompts, effectively locking the legitimate user out while maintaining undetectable account access.
Stage 4: Data Enumeration and Mass Exfiltration
With persistent access secured, the attackers conduct rapid reconnaissance of the compromised SharePoint environment, automating the process of identifying and cataloging all accessible content. This final stage reveals Helix's strongest technical fingerprint.
## Technical Details: The Operational Fingerprint
ReliaQuest researchers identified consistent technical patterns across multiple Helix incidents, providing forensic evidence of the group's infrastructure and automation practices.
Automated Enumeration Methodology
All observed Helix operations employed identical SharePoint enumeration techniques originating from the IP address 179.43.185.230, using a distinctive user-agent string: python-requests/2.28.1. The automation strategy employed two primary SharePoint search queries:
| Search Query | Purpose |
|---|---|
| contentclass:STS_Site | Identifies all SharePoint site collections and subsites |
| * (wildcard) | Retrieves all accessible content across the environment |
Bulk Data Exfiltration
Following enumeration, the attackers bulk-downloaded files directly from the compromised SharePoint environment using the same IP address and user-agent combination. The consistent nature of this operational pattern across incidents provides investigators with reliable attribution points and suggests either a standardized playbook or shared tooling across operations.
Infrastructure Indicators
## Background and Context: Links to Previous Extortion Groups
ReliaQuest's investigation suggests that Helix did not emerge in isolation but rather represents a continuation or evolution of previously active data-extortion operations, particularly ShinyHunters and the now-defunct BlackFile group.
Connections to BlackFile
The most concrete technical link involves infrastructure overlap. Researchers discovered that an exfiltration IP address used by Helix operates within the same autonomous system (AS 51852) that previously hosted confirmed BlackFile infrastructure. Additionally, the timing is suspicious: Helix's emergence coincides closely with BlackFile's shutdown in April 2026—suggesting operators may have rebranded and resumed operations under a new name rather than ceasing activity entirely.
Parallels with ShinyHunters
While no definitive technical connection has been established, Helix demonstrates striking operational similarities to ShinyHunters:
Broader Threat Landscape
ReliaQuest also notes that other groups—including Pink and Redact—may represent additional successors to BlackFile operations. The proliferation of splinter groups and rebrandings suggests that the underlying operational infrastructure and skillsets from defunct extortion operations have not disappeared but rather fragmented across multiple active campaigns.
## Implications for Organizations
The emergence of Helix carries several troubling implications for enterprise security:
Increasing Reliance on Social Engineering
Helix's success demonstrates that sophisticated attackers are progressively moving away from technical vulnerability exploitation toward human-centered attacks. Traditional network perimeter defenses, vulnerability scanning, and patch management—while necessary—provide insufficient protection against well-executed vishing campaigns that target employee psychology rather than system weaknesses.
Microsoft 365 as a Persistent Target
The concentration of Helix attacks on SharePoint and Microsoft 365 reflects the widespread adoption of these platforms across enterprises. As organizations migrate toward cloud-based productivity suites, these services become increasingly attractive targets for extortion groups seeking high-value data with minimal technical barriers.
MFA as a Double-Edged Sword
The irony of Helix's success is that victim organizations often implemented MFA specifically to prevent unauthorized access. However, device code authentication—designed for usability in environments where typing passwords is impractical—introduces an authentication vector that employees can unknowingly compromise without realizing they are granting access to attackers.
Ransomware-as-Extortion Hybrid Model
Unlike traditional ransomware operators, Helix combines data theft with extortion threats—a model that removes the organization's ability to simply pay a ransom and move forward. Stolen data enables threats to publish proprietary information, customer data, or intellectual property, creating legal, financial, and reputational consequences that persist indefinitely.
## Recommendations for Defenders
Immediate Actions
1. Disable device code authentication where feasible, particularly for privileged accounts and non-essential scenarios. If device code authentication must remain enabled, restrict it to managed devices only and monitor for suspicious device registrations.
2. Restrict SharePoint access to managed corporate devices, preventing access from uncontrolled personal devices or external systems. Implement conditional access policies that enforce device compliance requirements.
3. Audit MFA registrations across all Microsoft 365 tenants, identifying and removing any suspicious authenticator apps or registered devices that users do not recognize.
4. Block communications with newly registered domains using DNS filtering or email gateway controls. Threat actors commonly register domains within hours of initiating campaigns; blocking domains younger than 30 days eliminates many attack vectors.
Longer-Term Defenses
## HackWire Analysis
The emergence of Helix represents a crucial inflection point in the cybersecurity threat landscape: the mainstream professionalization of voice phishing as a primary attack vector for high-value data theft.
What makes Helix significant is not novel technology—device code phishing and MFA bypasses were known vulnerabilities before this group weaponized them—but rather the *operational standardization* and *scaling* of social engineering at enterprise level. The identical enumeration patterns across victims, the consistent infrastructure, the rapid progression from initial compromise to exfiltration: these indicate a mature, repeatable operation that works reliably enough to attract multiple victim organizations worth targeting.
The likely succession from BlackFile also matters. When major cybercriminal operations shut down, conventional wisdom suggests that criminal activity declines. In reality, experienced operators simply rebrand and resume. Helix's infrastructure overlap with BlackFile suggests that the same technical skills, targeting lists, and operational procedures persist—merely under new branding. This pattern will repeat: each time law enforcement or security researchers dismantle a notorious extortion group, its successor emerges with slightly modified tactics but identical strategic objectives.
The uncomfortable truth for defenders is that vishing remains difficult to prevent at scale because it exploits irreducible human factors. No technical control blocks a well-crafted social engineering call. Organizations cannot simply patch employee psychology. The only mitigation that actually works—independent verification of sensitive requests through known channels—requires cultural change and executive commitment. Most organizations lack both. Until that changes, groups like Helix will continue exploiting the gap between theoretical security controls and actual human behavior.
— *HackWire Editorial*
## Related Coverage