Loading story…
The Helix data-extortion group is targeting Microsoft 365 environments with voice phishing, device code phishing, and MFA abuse to hijack authenticated cloud sessions and steal data from SharePoint. ReliaQuest reported that after gaining access, the attackers quickly establish persistence by registering a new authenticator app, then enumerate SharePoint content and exfiltrate files for extortion or resale. In some observed cases, Helix moved from initial access to bulk SharePoint theft in less than an hour, while other intrusions involved quieter reconnaissance across email and SharePoint before mass downloads.
Researchers said Helix uses target-specific phishing subdomains, newly registered domains, residential proxies mapped to a victim’s city, and rotating source IPs to make logins appear legitimate while leaving few malware artifacts. A notable indicator was automated SharePoint enumeration and bulk download activity from IP address 179.43.185.230 using the python-requests/2.28.1 user agent. ReliaQuest said the group may overlap with the ShinyHunters or BlackFile extortion ecosystems, though attribution remains unconfirmed, and recommended disabling device code authentication where possible, restricting SaaS and SharePoint access to managed devices, and blocking newly registered domains tied to the campaign.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
ReliaQuest assessed that Helix may have emerged from or overlaps with the ShinyHunters and BlackFile extortion ecosystems based on similarities in timing, infrastructure, and tradecraft. The researchers said they did not establish a definitive attribution link.
ReliaQuest reported a new data-extortion group called Helix conducting identity-focused attacks against Microsoft 365 tenants using vishing, device code phishing, and MFA abuse, with a focus on stealing data from SharePoint. The report also described Helix’s persistence via newly registered authenticator apps and its rapid cloud-based exfiltration workflow.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcereliaquest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders are warning that attackers are increasingly abusing Microsoft Entra ID's OAuth 2.0 **device code flow** to hijack Microsoft 365 accounts through legitimate sign-in prompts rather than malware or software exploits. In these attacks, victims are tricked via **vishing** or phishing into entering an attacker-supplied code at Microsoft's device login page and approving MFA, which issues the attacker valid access and refresh tokens. Security firms say the technique can provide broad access to services including **Microsoft Graph**, **Exchange Online**, **OneDrive**, and **SharePoint**, and that password resets alone may not fully contain the intrusion because refresh tokens can persist across services. The activity has been tied to data theft and follow-on abuse. ReliaQuest reported that the **Helix** extortion group used device code phishing, MFA abuse, and rogue authenticator registration to access victim Microsoft 365 tenants, enumerate SharePoint, and exfiltrate data before extortion; reported victims include Medtronic, Nissan, NAIC, Kodak, Infinite Campus, and the University of Nottingham. Separate investigations documented attackers signing in from foreign locations, registering multiple devices, creating hidden inbox rules to suppress replies, and using compromised mailboxes to send phishing messages at scale. Microsoft and security researchers recommend blocking or restricting device code authentication with **Conditional Access**, limiting SharePoint and device registration to managed devices, and monitoring Entra ID telemetry for `AuthenticationProtocol` set to device code, unusual travel, mailbox rule changes, and spikes in device registrations.
Jul 23, 2026
The PREY-0058 threat cluster is targeting executives with voice-phishing calls impersonating internal IT help-desk staff. Operators direct victims to fraudulent Microsoft 365 authentication pages using adversary-in-the-middle phishing, capturing credentials, MFA approvals, and authenticated session tokens. They replay those tokens through residential proxies—frequently NodeMaven addresses selected to match the victim’s apparent geography and network profile—to bypass normal MFA protections. After gaining access, the attackers enumerate Microsoft Entra ID and SharePoint and bulk-exfiltrate information from SharePoint, OneDrive, Exchange, and Box before issuing extortion demands. The activity overlaps with tradecraft attributed to UNC6671 and potentially Cinder or Pink-linked operations. Organizations should verify unexpected IT calls through trusted channels, require managed devices and phishing-resistant MFA such as FIDO2 keys or device-bound passkeys, restrict proxy-originated access, enable Continuous Access Evaluation, and monitor for token replay and anomalous bulk SaaS-data collection.
Sep 9, 2026
A newly tracked extortion group known as **Pink** is using voice phishing and fake internal help-desk calls to trick employees into entering credentials and MFA codes on attacker-controlled phishing pages. Researchers tracking the activity as `CL-CRI-1147` said the actor appears likely **Com-affiliated** and follows a social-engineering playbook associated with groups such as Lapsus$, Scattered Spider, and ShinyHunters. After account takeover, Pink rapidly accesses Microsoft cloud services including **SharePoint** and **OneDrive**, steals sensitive data, and then uses the compromised accounts to send extortion emails and internal **Microsoft Teams** messages to pressure victims. Investigators said the group has also stood up a leak site and typically gives organizations **72 hours** to respond to extortion demands. The campaign shows repeated infrastructure reuse across victims, with common second-level domains and victim-specific subdomains, and phishing hosting frequently tied to **DDoS-Guard**. Reported indicators include the domains `passkeyadd.com`, `passkeydeploy.com`, and `deploypasskey.com`, along with the IP addresses `185.178.208.153`, `172.93.100.252`, and `96.232.20.66`, giving defenders concrete artifacts for threat hunting and blocking.
Jun 29, 2026