Helix vishing group targets SharePoint data

A new data-extortion group called Helix uses vishing, device code phishing, and MFA abuse to steal data from SharePoint environments. Helix operators impersonate managers via caller ID spoofing, trick targets into device-code phishing, register a new MFA authenticator, then enumerate and exfiltrate SharePoint files. ReliaQuest researchers link Helix to ShinyHunters and BlackFile groups.