Helix: the new extortion crew phoning staff to raid SharePoint files
Researchers at ReliaQuest say the group impersonates managers on the phone, tricks staff into a login trap, then pulls company documents from Microsoft SharePoint.
Key points
- A new data-extortion crew tracked as Helix is calling employees while pretending to be their manager, then stealing files from Microsoft SharePoint, according to ReliaQuest.
- Helix operators register their own authenticator app on the victim's account to keep access, then bulk-download SharePoint content from a single IP address (179.43.185.230).
- ReliaQuest assesses with medium confidence that Helix overlaps with ShinyHunters and the now-defunct BlackFile extortion cluster, based on shared tactics and hosting infrastructure (AS 51852).
- ShinyHunters victims confirmed in the past month include Medtronic, Nissan, NAIC, Kodak, Infinite Campus, Nottingham University.
- The single strongest defence, per ReliaQuest, is disabling device-code authentication where possible.
A fresh data-extortion crew has surfaced, and its opening move is a phone call.
Analysts at ReliaQuest are tracking the group as Helix. Its playbook isn't clever code. It's a convincing voice on the line.
How does the attack actually start?
With a phone call to an employee, often from someone claiming to be their own manager. The caller uses the real manager's name and in some cases spoofs the caller ID so the number looks right too.
This is called vishing, short for voice phishing, where criminals ring staff and talk them into doing something risky. In Helix's case, the goal is device-code phishing, a trick that abuses a legitimate Microsoft sign-in flow: the attacker generates a code on their own machine, then convinces the employee to type it into a real Microsoft login page. The employee thinks they're helping IT. They've just signed the attacker into their account. We covered the mechanics of this technique in depth on 19 June.
Once inside, Helix moves fast. Operators enroll their own multi-factor authenticator app, the second step that normally blocks intruders, so they can return even if the password changes. Then they go hunting through SharePoint, Microsoft's cloud file-sharing service used by most large organisations for internal documents.
What do they take, and what happens next?
Files, lots of them. ReliaQuest says the enumeration is machine-like and identical across incidents, which is why they treat it as Helix's clearest fingerprint. The automated scraping ran from 179.43.185.230 using the python-requests/2.28.1 user-agent, with wildcard SharePoint searches to list every reachable document before bulk-downloading it.
Stolen data is then used to squeeze the victim: pay up, or we publish. Some batches get sold to other criminals instead.
Is Helix really a new group?
Maybe not entirely. ReliaQuest links Helix, with medium confidence, to ShinyHunters and BlackFile. The evidence is circumstantial but consistent.
One Helix exfiltration IP sat in the same autonomous system, AS 51852, that previously hosted a confirmed BlackFile address. BlackFile shut down in April; Helix appeared shortly after. ReliaQuest also flags Pink and Redact as possible offshoots. Our story from 8 July reported on Pink's near-identical phone-based account takeover technique, which makes the family resemblance hard to ignore.
The ShinyHunters overlap is behavioural: same social-engineering script, same fondness for Microsoft 365 and SharePoint, same use of the NICENIC domain registrar seen in earlier ShinyHunters campaigns. Recent ShinyHunters victims, as first reported by BleepingComputer, include Medtronic, Nissan, NAIC, Kodak, Infinite Campus and Nottingham University.
Helix isn't bringing novel malware. What it has is a slick identity-abuse routine that works against companies with strong perimeters but tired employees. That's the uncomfortable part of this assessment.
What should organisations do about it?
ReliaQuest's headline recommendation is blunt: turn off device-code authentication if your business doesn't need it. That single change removes the trick at the heart of the intrusion.
Beyond that, restrict SharePoint access to company-managed devices and block traffic to newly registered domains, which Helix leans on heavily. Warn staff, in plain terms, that a caller claiming to be their boss and asking them to type a code into a Microsoft page is the attack.
