Helix Data Extortion via Vishing and SharePoint Exfiltration

ReliaQuest identified a previously unreported group called Helix running multi-target data extortion campaigns. Helix likely emerged from the BlackFile and ShinyHunters ecosystem. BlackFile shut down in April 2026 and split into successors such as Pink and Redact. ReliaQuest says this stops short of confirmed attribution. Helix operators call targets and have spoofed the target's manager by name on caller ID. In a confirmed case the caller walked the user through entering a device code in Chrome. The user never shared a credential over the phone but the operator still ended up with an authenticated session token. After the sign-in, the operator registers a new MFA Authenticator app within minutes. Sign-ins come from residential proxies matched to the target's city, which keeps impossible travel alerts quiet. Collection runs through a scripted client that identifies as python-requests/2.28.1. It enumerates SharePoint with contentclass:STS_Site and wildcard searches and then bulk downloads from 179.43.185[.]230. In one case SharePoint access began six minutes after MFA registration. Another intrusion went from access to mass exfiltration in under an hour.

Helix also appears to split the work across two accounts.. The first compromised user quietly enumerates and downloads SharePoint libraries over several days. A second user, compromised days or weeks later, only delivers the extortion demand through Teams and email. Investigating only the account that posted the demand misses the data theft. Hunt for bulk SharePoint activity across all accounts and look back one to two months.