New Helix vishing group emerges in SharePoint data theft attacks

ReliaQuest has identified a data-extortion group called Helix that uses social-engineering-heavy tactics (vishing, device-code phishing, MFA abuse) to access Microsoft 365/SharePoint accounts, register persistent authenticators, automate enumeration/download of SharePoint content (notably from IP 179.43.185.230 with user-agent 'python-requests/2.28.1'), and exfiltrate files to extort or sell; researchers note connections to ShinyHunters and BlackFile and recommend disabling device code authentication and restricting SharePoint to managed devices.