A New Name in the Data Extortion Ecosystem?

Helix is a data extortion threat actor identified by AlienVault as conducting campaigns that combine vishing, device code phishing, and automated SharePoint enumeration and exfiltration. The group likely originated from the BlackFile and ShinyHunters ecosystem after BlackFile ceased operations in April 2026. Helix employs sophisticated social engineering, impersonating managers by name during vishing calls to initiate device code authentication flows, enabling account compromise. Post-compromise, attackers register multi-factor authentication on accounts to maintain persistent access, then use automated tools with a python-requests user-agent to enumerate SharePoint sites and perform bulk data exfiltration. Their infrastructure includes phishing domains registered via NICENIC with target-specific subdomains and is hosted on the same autonomous system as BlackFile, showing operational ties. The group uses residential proxies geo-matched to targets to avoid detection and varies dwell times to complicate response efforts.

Helix's activities enable unauthorized access to corporate accounts through social engineering and device code phishing, allowing attackers to register MFA on compromised accounts and maintain persistent access. This facilitates extensive enumeration and exfiltration of sensitive data from SharePoint environments. Their use of geo-matched residential proxies and shared infrastructure with previous threat groups complicates detection and response. The campaign poses a medium-level risk of data loss and extortion to targeted organizations.

No official patch or fix exists as this is a threat actor campaign rather than a software vulnerability. Organizations should strengthen defenses against social engineering and device code phishing by providing user awareness training to recognize vishing attempts impersonating managers. Monitoring for unusual MFA registrations and suspicious SharePoint enumeration activity can aid in early detection. Implement strict access controls and anomaly detection on authentication flows and SharePoint access. Review and restrict the use of device code authentication flows where feasible. Continuous monitoring and incident response preparedness are essential given the lack of vendor advisories or patches.