New Helix Extortion Group Targets Enterprises With MFA Abuse and SharePoint Exfiltration

ReliaQuest describes "Helix," a data-extortion operation that leverages vishing and device-code phishing to capture identity session tokens, rapidly enrolls MFA for persistence, then performs scripted SharePoint enumeration and bulk downloads from hosted infrastructure (notably 179.43.185.230); the report includes IOCs, links Helix to the BlackFile/ShinyHunters ecosystem, and recommends disabling device-code flows, monitoring MFA enrollments and SharePoint queries, and rapid automated incident response.