Helix Vishing Attacks Bypass MFA to Steal SharePoint Data

By Yonatan Hoorizadeh — CISSP, CISM, CRISC, AAISM

Published By: Purple Shield Security

Published: July 10, 2026

Last updated: July 10, 2026

Helix is a data extortion group that phones employees, impersonates their manager, and talks them into entering a device code that hands the attacker a valid Microsoft 365 session. No password is stolen and MFA is not triggered. Once inside, Helix registers its own authenticator and bulk-downloads SharePoint files for extortion.

What happened with the Helix group?

Security firm ReliaQuest disclosed a previously unreported data extortion group it named Helix that steals corporate data from Microsoft 365 and SharePoint using phone calls and identity tricks rather than malware. The group calls an employee, impersonates a trusted person, and walks them into an authentication flow that quietly hands over account access. BleepingComputer and multiple outlets confirmed the ReliaQuest findings on July 9, 2026.

The attack chain is deliberately quiet. According to ReliaQuest, operators open with a voice phishing (vishing) call, sometimes spoofing a direct manager by name and caller ID. They then guide the target through device code phishing, which captures a session token issued by the identity provider. The victim never types a password over the phone, which is exactly why so many employees do not recognize it as handing over the keys.

ReliaQuest tied Helix to the same ecosystem that produced the now-defunct BlackFile group and the prominent extortion brand ShinyHunters, citing shared infrastructure, a common domain registrar, and a near-identical playbook. The group runs an identity-first operation, meaning it goes after accounts and sessions rather than software flaws.

ReliaQuest framed the takeaway plainly: these are "different labels but recurring TTPs" (tactics, techniques, and procedures), meaning the names change while the tradecraft and infrastructure endure.

On the same day, identity provider Okta issued a separate advisory warning of a surge in vishing aimed at Microsoft 365 customers. Two firms flagging the same pattern independently is a signal that this is a broad campaign, not one isolated victim.

How does Helix bypass MFA if the victim never shares a password?

Helix abuses Microsoft's OAuth Device Code Flow, a legitimate feature built for devices that cannot easily show a login page, such as smart TVs and consoles. The attacker starts a device code request for the target's account, then convinces the employee to enter the generated code at the real Microsoft login page. Microsoft then issues a valid session token to the attacker. The login happens on Microsoft's own infrastructure, so there is no fake page for security tools to catch.

Because the session is authenticated through the legitimate flow, it sails past the Conditional Access assumptions many companies rely on. ReliaQuest observed that once inside, Helix registered a new multi-factor authentication (MFA) authenticator app on the account within minutes to lock in persistence. In one case, ReliaQuest reported SharePoint access went through with no recorded authentication method just six minutes after the actor completed MFA registration, suggesting the stolen session token was simply replayed.

This is the part that trips up leaders who believe MFA closed this door. MFA stops password reuse and credential stuffing. It does not stop an employee who is socially engineered into approving access in real time. The attacker did not defeat the MFA math. They convinced a human to open the door and then changed the locks behind them.

Why does this matter for a mid-market business?

Mid-market firms are the soft target for this exact playbook because they run Microsoft 365 and SharePoint, store years of sensitive files there, and rarely have a hardened help desk that verifies identity before acting on a phone request. Helix does not need a vulnerability in your software. It needs one employee who trusts a phone call, and most companies have hundreds of those.

The damage model is also different from ransomware, which makes it easy to miss. ReliaQuest noted that SharePoint exfiltration does not trigger an immediate outage: systems keep running, production metrics look normal, and the victim often does not learn anything is wrong until Helix presents an extortion demand. There is no encrypted server to alert you. The first sign of trouble is a ransom note referencing your own files.

For a regulated business, the stolen files are the whole exposure. Client records, contracts, health or financial data sitting in SharePoint become the basis for extortion and, potentially, for breach notification obligations. This is where independent security leadership earns its keep. A fractional CISO looks at where sensitive data actually lives and who can reach it, not just whether MFA is switched on. Purple Shield's vCISO services exist to own that question before an attacker answers it for you.

How would a vCISO triage a suspected Helix intrusion?

In the first 24 to 72 hours, a virtual Chief Information Security Officer (vCISO) would treat this as an identity incident, not a malware incident, and move on both cloud and on-premises identity at the same time. ReliaQuest was explicit that standard steps like password resets, session revocation, and account disablement still work, but only if they happen fast and everywhere at once. Reset the password on one side while a live session token stays valid on the other, and you have accomplished nothing.

The response window is narrow by design. ReliaQuest documented a case where the attacker tried to re-register MFA and reset the password shortly after the account was disabled, racing the defenders for control of the identity. That is why the triage order matters: revoke active sessions and tokens, remove attacker-registered MFA methods, then reset credentials, and confirm no lingering session survives on any endpoint.

The practitioner point that most coverage underplays is timing. This is not a "patch it Monday" event. It is a "who is on call to revoke a session at 9pm on a Friday" event. Fractional CISO services matter here precisely because the difference between a contained incident and a data extortion headline is measured in hours, and someone has to own that clock before the call comes in.

What should a business do?

The single highest-impact move, according to ReliaQuest, is disabling device code authentication wherever your environment does not genuinely need it. That one setting removes the flow this entire attack depends on. Most organizations are not using device code auth for anything critical and will never notice it is gone.

Beyond that, ReliaQuest recommends restricting sensitive SaaS access to managed, compliant devices so an attacker signing in from an unmanaged laptop is blocked at the session level, and blocking newly registered domains at the proxy or DNS layer, since extortion crews stand up fresh phishing domains days before a campaign. On the human side, the fix is a help desk and workforce that treat "enter this code" and "approve this login" phone requests as the credential-sharing events they actually are.

If you are not certain whether your Microsoft 365 tenant allows device code authentication today, or whether your team would catch a rogue MFA registration, that uncertainty is the finding. Purple Shield helps mid-market and regulated businesses close exactly these identity gaps through vCISO and fractional CISO services built around how attacks like Helix actually unfold.

Frequently asked questions

Does disabling device code authentication break anything?

For most organizations, no. Device code flow was built for input-limited hardware like smart TVs and conference room devices, not everyday laptop or phone logins. Before disabling it broadly, confirm no business-critical device or legacy integration depends on it, then turn it off through Conditional Access. ReliaQuest identifies this as the single highest-impact mitigation against Helix.

We already have MFA. Why did it not stop this?

MFA stops stolen passwords, not socially engineered approvals. Helix uses device code phishing, so the employee completes a real Microsoft login and the attacker receives the resulting session token. The attacker then registers their own MFA authenticator on the account. MFA was satisfied, just by the wrong person, which is why identity monitoring and session control matter alongside MFA.

How fast do we need to respond if we suspect an account is compromised?

Hours, not days. ReliaQuest documented attackers moving from access to bulk SharePoint exfiltration in under an hour in some cases, and attempting to re-register MFA and reset passwords immediately after an account was disabled. Effective response means revoking active sessions and tokens, removing attacker-added MFA methods, and resetting credentials across both cloud and on-premises identity at the same time.

Is this only a Microsoft 365 problem?

The Helix campaign targets Microsoft 365 and SharePoint specifically, but the underlying technique, tricking a user into approving legitimate authentication, applies to any identity provider that supports device code or similar flows. Okta issued its own vishing advisory the same day. Treat this as an identity-attack pattern to defend against broadly, not a single-vendor bug.

Helix is one name in a fast-rotating extortion ecosystem, but the identity gap it walks through is common and fixable. If you want a clear read on whether your Microsoft 365 environment and your help desk are ready for a vishing-driven attack like this, that is a conversation worth having. Purple Shield Security provides independent, vendor-neutral vCISO and fractional CISO services for mid-market and regulated businesses. Reach out to talk it through.