Helix is a data-extortion group employing identity-focused social engineering techniques such as vishing and device code phishing to compromise SharePoint accounts. Initial access is gained by impersonating managers in phone calls to employees, leading to MFA abuse by registering new authenticators. The group then performs automated SharePoint enumeration and bulk data exfiltration using consistent technical fingerprints (e.g., python-requests/2.28.1 user-agent from a specific IP). Researchers at ReliaQuest link Helix to former groups ShinyHunters and BlackFile based on shared infrastructure and tactics. The stolen data is used for ransom extortion or sold to other criminals. Recommended defenses include disabling device code authentication, limiting SharePoint access to managed devices, and blocking exchanges with newly registered domains.

Helix's attacks result in unauthorized access to SharePoint environments, leading to large-scale data theft. The stolen data is leveraged for extortion by threatening publication or sold to other cybercriminals. This compromises organizational confidentiality and can cause financial and reputational damage. The abuse of MFA and social engineering techniques bypasses common authentication protections, increasing the risk of successful breaches.

No official patch is applicable as this is a social engineering and authentication abuse threat. The highest-impact mitigation is to disable device code authentication where possible, as recommended by researchers. Additional measures include restricting SharePoint access to managed devices only and blocking communications with newly registered domains commonly used by Helix. Organizations should also educate employees about vishing and impersonation tactics to reduce susceptibility.