Helix is a data extortion group identified conducting campaigns using vishing, device code phishing, and automated SharePoint exfiltration. The group likely originated from the BlackFile and ShinyHunters ecosystem after BlackFile ceased operations in April 2026. Helix employs advanced social engineering tactics, impersonating managers by name during vishing calls to trigger device code authentication flows. After gaining access, attackers register multi-factor authentication on compromised accounts, enumerate SharePoint sites using automated tools with a python-requests user-agent, and perform bulk data exfiltration. Their infrastructure includes phishing domains registered via NICENIC with target-specific subdomains and is hosted on the same autonomous system as BlackFile, indicating operational links. The group uses residential proxies geo-matched to targets to avoid detection and demonstrates flexible operational timelines.

The Helix group’s activities enable unauthorized access to corporate accounts through social engineering and device code phishing, leading to the registration of MFA on compromised accounts. This facilitates persistent access and allows attackers to enumerate and exfiltrate large volumes of sensitive data from SharePoint environments. The use of sophisticated evasion techniques such as geo-matched residential proxies and shared infrastructure complicates detection and response efforts. The campaign poses a medium-level risk of data loss and extortion to targeted organizations.

No official patch or fix is applicable as this is a threat actor campaign rather than a software vulnerability. Organizations should focus on strengthening defenses against social engineering and device code phishing, including user awareness training to recognize vishing attempts impersonating managers. Monitoring for unusual MFA registrations and suspicious SharePoint enumeration activity can help detect compromise. Implementing strict access controls and anomaly detection on authentication flows and SharePoint access is recommended. Review and restrict use of device code authentication flows where possible. Since no vendor advisory or patch is available, continuous monitoring and incident response preparedness are essential.