New Helix Vishing Group Targets SharePoint with MFA Abuse and Data‑Extortion Tactics
What Happened — A newly identified extortion group, Helix, is using voice‑phishing (vishing), device‑code phishing, and MFA abuse to gain access to Microsoft SharePoint environments. After convincing victims to register a new authenticator app, the actors enumerate and bulk‑download SharePoint files, then threaten to publish or sell the data for ransom.
Why It Matters for Compliance & Audit Readiness
- The attack chain directly targets the SOC 2 Access Control criteria (CC6.1, CC6.2) by subverting MFA and exploiting human‑based credential acquisition.
- Continuous evidence of MFA policy enforcement, device‑code flow restrictions, and privileged‑access monitoring is essential to demonstrate due diligence during a SOC 2 audit.
- Mapping this scenario to Verisq’s SOC2 Access Controls capability helps you collect real‑time proof that MFA controls are enforced and that anomalous authentication attempts are logged and investigated.
Who Is Affected — Enterprises across health‑tech, automotive, insurance, media, education, and any organization that stores data in Microsoft 365/SharePoint.
Recommended Actions
- Disable the OAuth device‑code flow for all users where it is not required.
- Enforce conditional‑access policies that block registration of new authenticator apps without multi‑step verification.
- Implement continuous monitoring of MFA enrollment events and anomalous SharePoint enumeration activity.
- Conduct a SOC 2 access‑control gap analysis and capture audit‑ready evidence of the controls above.
Source: BleepingComputer
Technical Notes
- Attack vector: vishing → device‑code phishing → MFA app registration.
- No public CVE; the technique exploits legitimate Microsoft OAuth endpoints (device‑code flow).
- Exfiltration performed via a single IP (179.43.185.x) using python‑requests/2.28.1 user‑agent.
Source: same as above