Executive Summary
Helix is a fast-moving data extortion group that has emerged as a significant threat to Microsoft 365 environments. Unlike traditional ransomware actors, Helix focuses on identity abuse and cloud-native exfiltration, primarily targeting SharePoint libraries. The group leverages sophisticated vishing (voice phishing) and device code phishing to bypass MFA and gain authenticated session tokens without ever requiring the victim's password.
Technical analysis suggests that Helix may be a successor to or related to other extortion operations like ShinyHunters and BlackFile, sharing similar infrastructure and social engineering playbooks. Once initial access is established, the group moves rapidly to register a new MFA device for persistence and uses automated tools for bulk SharePoint enumeration and exfiltration, often completing the cycle within hours. The impact ranges from small enterprises to large organizations with high-value intellectual property.