Helix Data-Extortion Group Emerges Targeting M365 via Device-Code Phishing and Automated SharePoint Bulk-Exfiltration

ReliaQuest disclosed a previously unreported extortion operation dubbed Helix that chains caller-ID-spoofed vishing calls with Microsoft OAuth Device Code Flow abuse to harvest M365 session tokens — bypassing all credential and MFA controls — then registers a new MFA authenticator for persistence and bulk-downloads SharePoint content via automated enumeration, all without deploying any malware. Infrastructure analysis places Helix in the same autonomous system (AS 51852) as confirmed BlackFile (UNC6671) infrastructure, and the group uses the same NICENIC registrar as ShinyHunters, strongly suggesting it is a post-BlackFile successor operating the same tradecraft under a new brand. Okta simultaneously issued an advisory on the same day warning of a parallel vishing surge against M365 customers, indicating the pattern has scaled beyond a single actor; disabling Device Code authentication flows is the single highest-impact mitigation.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.