New Helix Extortion Group Targets Enterprises With MFA Abuse and SharePoint Exfiltration

Gbhackers •Mayura Kathir • July 9, 2026

A previously unreported data extortion operation dubbed “Helix” that targets enterprises using identity-focused entry techniques and automated SharePoint exfiltration. The group’s playbook combines voice phishing (vishing), device-code phishing to capture session tokens and bypass Conditional Access controls, rapid MFA registration for persistence, and scripted enumeration and bulk download of SharePoint content all staged from shared […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Helix Data Extortion Group Targets SharePoint with Vishing and Phishing Tactics A new data extortion group named Helix has emerged, utilizing identity-focused tactics such as vishing and device code phishing to exploit Microsoft 365 environments. The group primarily targets SharePoint, employing social engineering techniques to trick employees into providing access to their accounts. Helix's operations involve spoofing calls from managers to gain trust, followed by phishing schemes to capture session tokens and bypass multi-factor authentication (MFA). Once inside, attackers quickly register new MFA apps for persistence and automate the enumeration and bulk download of SharePoint libraries. The stolen data is then used to extort organizations, threatening to publish or sell the information unless a ransom is paid. Helix appears to have links to the now-defunct BlackFile and ShinyHunters groups, suggesting a continuation of similar tactics. Security experts recommend disabling device code authentication and restricting access to managed devices to mitigate risks. 5 sources 68

Extracted Entities

New Helix Extortion Group Targets Enterprises With MFA Abuse and SharePoint Exfiltration

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

MITRE ATT&CK (2)

Platforms (1)