Helix, a New Name in the Data Extortion Ecosystem?

ReliaQuest documents an active data-extortion campaign carried out by a group named "Helix" that leverages social engineering (vishing and device-code phishing) to capture session tokens, register MFA for persistence, and perform automated SharePoint enumeration and bulk exfiltration from hosted infrastructure (notably IP 179.43.185.230 and domain oskeysync.com). The report links Helix’s playbook and infrastructure to the fragmented BlackFile/ShinyHunters ecosystem, describes a tactical pattern of separating exfiltration and extortion accounts, and provides detection and containment recommendations—disable device code authentication, restrict SaaS to managed endpoints, block newly registered domains, and hunt broadly for non-interactive sign-ins and bulk SharePoint downloads.