Loading story…
The Helix data-extortion group is targeting Microsoft 365 environments with voice phishing, device code phishing, and MFA abuse to hijack authenticated cloud sessions and steal data from SharePoint. ReliaQuest reported that after gaining access, the attackers quickly establish persistence by registering a new authenticator app, then enumerate SharePoint content and exfiltrate files for extortion or resale. In some observed cases, Helix moved from initial access to bulk SharePoint theft in less than an hour, while other intrusions involved quieter reconnaissance across email and SharePoint before mass downloads.
Researchers said Helix uses target-specific phishing subdomains, newly registered domains, residential proxies mapped to a victim’s city, and rotating source IPs to make logins appear legitimate while leaving few malware artifacts. A notable indicator was automated SharePoint enumeration and bulk download activity from IP address 179.43.185.230 using the python-requests/2.28.1 user agent. ReliaQuest said the group may overlap with the ShinyHunters or BlackFile extortion ecosystems, though attribution remains unconfirmed, and recommended disabling device code authentication where possible, restricting SaaS and SharePoint access to managed devices, and blocking newly registered domains tied to the campaign.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
ReliaQuest assessed that Helix may have emerged from or overlaps with the ShinyHunters and BlackFile extortion ecosystems based on similarities in timing, infrastructure, and tradecraft. The researchers said they did not establish a definitive attribution link.
ReliaQuest reported a new data-extortion group called Helix conducting identity-focused attacks against Microsoft 365 tenants using vishing, device code phishing, and MFA abuse, with a focus on stealing data from SharePoint. The report also described Helix’s persistence via newly registered authenticator apps and its rapid cloud-based exfiltration workflow.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcereliaquest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly tracked extortion group known as **Pink** is using voice phishing and fake internal help-desk calls to trick employees into entering credentials and MFA codes on attacker-controlled phishing pages. Researchers tracking the activity as `CL-CRI-1147` said the actor appears likely **Com-affiliated** and follows a social-engineering playbook associated with groups such as Lapsus$, Scattered Spider, and ShinyHunters. After account takeover, Pink rapidly accesses Microsoft cloud services including **SharePoint** and **OneDrive**, steals sensitive data, and then uses the compromised accounts to send extortion emails and internal **Microsoft Teams** messages to pressure victims. Investigators said the group has also stood up a leak site and typically gives organizations **72 hours** to respond to extortion demands. The campaign shows repeated infrastructure reuse across victims, with common second-level domains and victim-specific subdomains, and phishing hosting frequently tied to **DDoS-Guard**. Reported indicators include the domains `passkeyadd.com`, `passkeydeploy.com`, and `deploypasskey.com`, along with the IP addresses `185.178.208.153`, `172.93.100.252`, and `96.232.20.66`, giving defenders concrete artifacts for threat hunting and blocking.
Jun 29, 2026
Microsoft disclosed multiple on-premises SharePoint Server vulnerabilities, including remote code execution flaws `CVE-2025-49701` and `CVE-2025-49704` and spoofing flaw `CVE-2025-49706`, as defenders responded to active exploitation. Microsoft said it was working to disrupt attacks targeting exposed SharePoint environments, while the Canadian Centre for Cyber Security issued threat-detection guidance to help organizations identify compromise tied to the SharePoint vulnerabilities. Subsequent reporting tied the broader **ToolShell** exploitation chain, including `CVE-2025-53770`, to China-linked operators that breached a Middle Eastern telecom provider, government departments in Africa, government agencies in South America, and a U.S. university. Investigators said the intrusions used malware and tooling including **Zingdoor**, **ShadowPad**, **KrustyLoader**, and **Sliver**, alongside credential-dumping, proxying, DLL sideloading, and persistence techniques, indicating a stealthy espionage-focused campaign that expanded beyond initial public understanding of the SharePoint attacks.
Jun 29, 2026
**ShinyHunters** has been linked to a wave of SaaS-focused data-theft and extortion activity enabled by targeted **voice phishing (vishing)** and company-branded phishing portals designed to capture **SSO credentials** and **MFA codes**. Mandiant reported that attackers impersonate IT/helpdesk staff, direct employees to realistic login pages, and use real-time interaction (including guiding victims to approve push prompts or provide one-time codes) to authenticate and then **enroll attacker-controlled devices into MFA**. After account takeover, the actor pivots through **Okta, Microsoft Entra, or Google** SSO dashboards to rapidly access downstream SaaS services (e.g., *Salesforce*, *Microsoft 365/SharePoint*, *DocuSign*, *Slack*, *Atlassian*, *Dropbox*, *Google Drive*), turning a single compromised identity into broad cloud data access. Separately, **Bumble** reported a phishing-driven compromise of a **contractor account**, after which ShinyHunters allegedly claimed theft of ~**30 GB** of data—reported as largely internal files sourced from **Google Drive** and **Slack**—while Bumble stated there was no evidence of exposure of user chats or profiles. Reporting also tied ShinyHunters to other claimed or alleged thefts affecting consumer and enterprise brands (including Match Group properties such as *Hinge*, *Match*, and *OkCupid*), consistent with the broader pattern of leveraging compromised identities and SaaS access paths for data exfiltration and extortion leverage.
Jun 29, 2026