A new data-extortion group tracked as Helix is combining voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to compromise Microsoft 365 accounts and steal data from SharePoint environments. The group, which cybersecurity firm ReliaQuest believes may have emerged from the ShinyHunters and BlackFile ecosystems, represents an evolving identity-focused threat that targets organizations through social engineering rather than traditional malware or exploitation of vulnerabilities.
How Helix Executes Its Vishing and Device Code Phishing Attacks
The initial attack vector is vishing, where threat actors call employees while impersonating a manager. In observed incidents, the caller used the manager’s name and, in some cases, caller ID spoofing to make the call appear legitimate. The goal of this social engineering is to convince the target to complete a device code authentication flow, which grants the attacker access to the victim’s Microsoft 365 account without requiring a password or bypassing MFA through a traditional phishing page.
Once inside the account, Helix operators quickly register a new multi-factor authenticator app to establish persistence. They then enumerate SharePoint sites and bulk-download files. The stolen data is used for extortion: the group threatens to publish the data unless a ransom is paid, or sells it to other cybercriminals.
Technical Fingerprint: SharePoint Enumeration and Exfiltration
ReliaQuest researchers identified a consistent technical signature across Helix incidents. Automated enumeration and collection ran from the IP address 179.43.185[.]230 using the python-requests/2.28.1codecodecodecodecode user-agent. The operator issued contentclass:STS_Site and wildcard (*) SharePoint searches to inventory all reachable content, then bulk-downloaded from the same IP and user-agent. This SharePoint exfiltration behavior is described as the group’s most reliable technical fingerprint.
What Is Device Code Phishing and Why Is It Effective?
Device code phishing is an attack technique that abuses the device code authorization flow used by Microsoft 365 and other identity platforms. In this flow, a user is presented with a code and directed to enter it on a separate device to authenticate. The attacker tricks the target into entering the code on a legitimate Microsoft login page, but the attacker controls the session. This method bypasses many traditional MFA protections because the user is authenticating directly with Microsoft’s own service. The highest-impact defensive measure against Helix attacks is to disable device code authentication where possible.
Links to ShinyHunters and BlackFile Data Extortion Groups
ReliaQuest assessed that Helix likely emerged from the ShinyHunters and BlackFile data extortion groups, though no definitive connection was established. The social engineering playbook is nearly identical to ShinyHunters: vishing, employee impersonation, targeting Microsoft 365, and stealing SharePoint data. Additionally, Helix uses the NICENIC registrar, which has been observed in past ShinyHunters campaigns.
Regarding BlackFile, one Helix attack used an exfiltration IP address in the same autonomous system (AS 51852) that hosted a confirmed BlackFile IP address, suggesting shared infrastructure. BlackFile ceased operations in April, and Helix emerged shortly after, which may indicate a continuation of the extinct operation. ReliaQuest also noted Pink and Redact as potential successors in the same ecosystem.
Recent victims linked to the ShinyHunters ecosystem include Medtronic, Nissan, NAIC, Kodak, Infinite Campus, and Nottingham University, all of which confirmed data breaches previously claimed by ShinyHunters.
Recommended Defenses Against Helix and Similar Identity-Based Attacks
Organizations should treat device code authentication as a high-risk feature and disable it wherever business requirements allow. Additional defensive measures include restricting SharePoint access to managed devices only and blocking authentication attempts from newly registered domains, which Helix typically uses in its attack infrastructure. Security teams should also monitor for the python-requests/2.28.1codecodecodecodecode user-agent combined with SharePoint enumeration patterns as a potential indicator of compromise.
What Affected Organizations Should Do Now
Organizations that suspect a Helix compromise should immediately audit all MFA registrations for unauthorized authenticator apps, revoke any device code authentication sessions, and rotate credentials for affected accounts. SharePoint audit logs should be reviewed for bulk download activity originating from unrecognized IP addresses. For organizations that cannot disable device code authentication entirely, implementing conditional access policies to restrict its use to trusted devices and locations is a critical mitigation step. Deploying a multi-layer endpoint protection solution with behavioral analysis capabilities can help detect the post-compromise enumeration activity that characterizes this threat.
