--- title: New Helix vishing group emerges in SharePoint data theft... description: A new data-extortion group called Helix is targeting organizations using voice phishing (vishing), device code phishing, and MFA abuse to gain access to... canonical: https://daily.dev/posts/new-helix-vishing-group-emerges-in-sharepoint-data-theft-attacks-kgc8xzchk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New Helix vishing group emerges in SharePoint data theft attacks | daily.dev og:description: A new data-extortion group called Helix is targeting organizations using voice phishing (vishing), device code phishing, and MFA abuse to gain access to... og:url: https://daily.dev/posts/new-helix-vishing-group-emerges-in-sharepoint-data-theft-attacks-kgc8xzchk og:image: https://api.daily.dev/og/posts/KGc8xzChK.png og:image:alt: New Helix vishing group emerges in SharePoint data theft attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New Helix vishing group emerges in SharePoint data theft attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary A new data-extortion group called Helix is targeting organizations using voice phishing (vishing), device code phishing, and MFA abuse to gain access to Microsoft 365 accounts and steal SharePoint data. Attackers impersonate managers via phone calls or caller ID spoofing to trick employees into device-code phishing schemes, then register a new MFA app for persistence before bulk-downloading SharePoint files. Researchers at ReliaQuest link Helix to the now-defunct BlackFile group and ShinyHunters based on shared infrastructure, social engineering tactics, and targeting patterns. Defensive recommendations include disabling device code authentication, restricting SharePoint access to managed devices, and blocking newly registered domains. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [New BlackFile extortion group linked to surge of vishing attacks](https://daily.dev/posts/new-blackfile-extortion-group-linked-to-surge-of-vishing-attacks-uhj38rvmj) · BleepingComputer · 0 upvotes · 0 comments - [Voice phishing skyrockets as smooth crims talk their way in](https://daily.dev/posts/voice-phishing-skyrockets-as-smooth-crims-talk-their-way-in-tjdntlll8) · The Register · 0 upvotes · 0 comments - [New phishing campaign tricks employees into bypassing Microsoft 365 MFA](https://daily.dev/posts/new-phishing-campaign-tricks-employees-into-bypassing-microsoft-365-mfa-2reed6azp) · CSO Online · 0 upvotes · 0 comments --- Tags: [#phishing](https://daily.dev/tags/phishing), [#sharepoint](https://daily.dev/tags/sharepoint), [#data-exfiltration](https://daily.dev/tags/data-exfiltration) [View this post on daily.dev](https://daily.dev/posts/new-helix-vishing-group-emerges-in-sharepoint-data-theft-attacks-kgc8xzchk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New Helix vishing group emerges in SharePoint data theft attacks","url":"https://daily.dev/posts/new-helix-vishing-group-emerges-in-sharepoint-data-theft-attacks-kgc8xzchk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-helix-vishing-group-emerges-in-sharepoint-data-theft-attacks-kgc8xzchk"},"datePublished":"2026-07-09T17:08:45.574Z","dateModified":"2026-07-09T17:26:40.882Z","description":"A new data-extortion group called Helix is targeting organizations using voice phishing (vishing), device code phishing, and MFA abuse to gain access to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e925dc2dc9200f0118de0f985e8260ad?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e925dc2dc9200f0118de0f985e8260ad?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-helix-vishing-group-emerges-in-sharepoint-data-theft-attacks-kgc8xzchk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"phishing,sharepoint,data-exfiltration","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"New Helix vishing group emerges in SharePoint data theft attacks"}]} ```