Key takeaways  

• Helix is the latest brand name of a data-theft extortion group that MOXFIVE suspects may have also used the brands BlackFile, Pink, Falcon, and Redact.  
• Helix intrusions rely on social engineering and usually begin with a phone call. A caller posing as IT support steers an employee to a lookalike passkey or MFA enrollment page that captures credentials and one-time codes in real time.
• Once inside, it exports data from SaaS platforms such as email, file storage, and CRM. In the cases MOXFIVE has investigated, it did not encrypt systems or compromise endpoints.
• Resetting a password in the identity provider often doesn't end the intrusion, because existing sessions and attacker-enrolled MFA devices can survive.
• The most effective defenses restrict who can enroll MFA methods and devices, revoke sessions across every connected app, and monitor bulk SaaS data access.

What Is Helix?

Helix is a financially motivated extortion group that uses rapid and aggressive tactics. Helix steals data from cloud and SaaS environments, then pressures victims to pay by threatening public release. Google Threat Intelligence Group (GTIG) tracks the activity as UNC6671 and reports that the BlackFile, Redact, Pink, Helix, and Falcon* brands share phishing infrastructure and tradecraft. It assesses that a common group is likely behind them, while noting other explanations remain possible.  

MOXFIVE has tracked Helix-branded activity since mid-2026 and has seen it accelerate this fall, including a new cluster of Helix-named matters in recent days and re-targeted victims. In several cases we investigated, a second intrusion came about a month after the first, using new user accounts and new phishing domains.

Who Does Helix Target?

In spring 2026, Helix targeted large enterprises in manufacturing, real estate, healthcare, and insurance and then moved in June toward large technology, transportation, and hospitality organizations holding intellectual property, source code, or sensitive client data. By July, it focused on industries where it could maximize leverage, such as financial and legal organizations.

While public victim postings are concentrated in the United States and span energy and utilities, manufacturing, transportation, and professional services, the common thread is identity. Any organization with Microsoft 365, Google Workspace, Okta, or Entra ID accounts and a help desk that takes calls is in scope.

What Helix Does Once Inside

Helix intrusions move quickly after gaining initial access. In our cases, SaaS access began within minutes, and data theft could finish within hours. Its activity follows a repeatable sequence:

• Lock in access: The actor enrolls its own MFA device, sometimes an emulated authenticator app, and may change passwords. It may delete security alert emails, so the victim doesn’t see them.
• Map the environment: With one valid identity, it reads tenant settings and exports directory data, such as user tables, to plan collection.
• Collect at scale: Scripts pull records through the Salesforce REST API, enumerate and crawl SharePoint search indexes, download files from Box and Google Drive, and read mailboxes through the Outlook REST API.
• Blend into normal traffic: Scripted collectors replay the stolen session from hosting providers, while interactive logins come through residential proxies or commercial VPNs. The scripted and interactive sessions present different user agents, which defenders can use as a hunting signal.
• Move data out: Files are synced to attacker-controlled cloud storage with tools such as rclone, sometimes through an OAuth app the attacker authorized.
• Pressure the victim: Extortion notes arrive through the victim's own email, Slack, Microsoft Teams, or Jira, typically with a short deadline (often 72 hours or Friday) and a way to contact the extortionists for negotiation, usually through the Tox encrypted messaging app.

Why Resetting Passwords Doesn't Stop Helix

• SaaS sessions issued before a reset kept working for days or weeks across applications such as Salesforce, ServiceNow, Box, and HubSpot.
• In one case, a rogue MFA device was removed, but active sessions weren't revoked. The actor returned about 19 days later and sent its ransom note from the victim's own mailbox.
• Attacker-authorized OAuth apps can retain access after a password reset.

Containment must reach every connected app. Revoke sessions, remove unknown MFA devices, review OAuth grants, and check again several weeks later, because the actor often returns.

How Helix Extorts Victims

In the cases MOXFIVE has investigated, Helix did not encrypt systems, so pressure comes from disclosure rather than downtime. Its tactics include:

• Notes sent from compromised accounts to executives and IT staff, which increases the pressure on leaders by demonstrating the extent of the attacker’s reach inside their defenses.
• Short deadlines and Tox negotiation channels, with deadlines extended when a victim stalls.
• Delayed demands. Extortion notes do not always follow the intrusion quickly. In some cases Helix claimed an attack more than a month after eviction, so a quiet period does not mean the data is safe.
• Pressure tactics against executives including phone calls, texts, and even possibly swatting.

In the cases MOXFIVE has investigated, no ransom was paid.

How to Defend Against Helix

Helix succeeds because identity controls can be bypassed. The defenses below work at several points in the attack chain.

• Block sign-ins from unmanaged devices: Use Conditional Access in Entra ID or device trust policies in Okta to require a managed or trusted device for SaaS sign-ins, with app-protection policies for personal phones. In our experience, a single device control would have blocked most Helix intrusions we've reviewed.
• Restrict access by network: Use default-deny allow lists for SaaS and API access where possible. Alert on sign-ins from commercial VPNs or residential proxy ranges that don't match a user's normal locations.
• Restrict who can enroll MFA methods and devices and from where: Registering its own MFA device is an ideal step for Helix to stay persistent. Limit enrollment to managed devices and trusted networks, use a controlled onboarding group for new enrollments, and alert on MFA enrollments that follow failed sign-ins.
• Enforce phishing-resistant MFA and close the fallbacks: Passkeys and FIDO2 security keys bind authentication to the real domain, so lookalike pages and real-time relay fail. But strong factors only help if SMS codes, one-time codes, and self-service password reset can't bypass them. As a result, phishing-resistant authenticators across all SSO environments are recommended.
• Revoke sessions in every federated app: Make session revocation a required step of identity containment. Shorten session lifetimes during active campaigns and use token binding or continuous access evaluation where your platform supports them.
• Restrict OAuth consent and review grants: Limit which third-party apps users can authorize, and alert on new grants with broad file or mailbox scopes.
• Monitor bulk data access: Alert on large downloads, bulk directory exports, search-index paging, and scripted API activity. Monitoring alone won't stop exfiltration, so pair it with blocking. Retain and forward SaaS audit logs, and enable field-level event logging where available, such as Salesforce Shield, so you can determine what left.
• Don't rely on mailbox alerts: Victims may never see the security notifications the actor deletes. Use provider-side audit logs for security alerts, new devices, and MFA changes.
• Train staff on vishing: No one should read an MFA code back to a caller, including someone who claims to be IT. Verify requests by calling a number from the internal directory, not one the caller provides, and brief help desk staff on MFA and password-reset procedures.

What to Check This Week

• Review MFA enrollments from the last 30 days and confirm each new authenticator matches a documented request.
• Confirm Conditional Access blocks unmanaged devices for SaaS sign-ins or document the exceptions.
• Review OAuth grants with broad file, mailbox, or directory scopes, and revoke unknown apps.
• Confirm SaaS audit logs are retained and forwarded to a location the actor can't edit.
• Brief help desk and executive support staff on vishing and callback verification.

Frequently Asked Questions

Is Helix ransomware?

Helix is best described as a data-theft and extortion group. In the cases MOXFIVE has investigated, it did not encrypt systems, so victims face disclosure risk rather than an outage. Extortion without encryption still requires a full response.

How does Helix get into an organization?

Mainly by phone. Attackers pose as IT or help desk staff and direct employees to a lookalike passkey or MFA enrollment page that captures credentials and one-time codes. Some cases also involve attacker-enrolled MFA devices or abused self-service password resets.

Why doesn't resetting a password stop Helix?

Active SaaS sessions and attacker-enrolled devices can survive a reset. Containment must revoke sessions in every connected app, remove unknown MFA devices, and review OAuth grants.

What should we do if we're targeted?

Revoke sessions, reset passwords, require MFA re-registration, and preserve logs. Contact MOXFIVE at 833-568-6695 or incident@moxfive.com.

MOXFIVE's Approach

MOXFIVE responds to identity-based extortion cases like these. Our Technical Advisors coordinate forensics, containment, and restoration with legal, insurance, and executive stakeholders so organizations can make decisions under pressure. If your organization believes it may be affected, contact our team at 833-568-6695 or incident@moxfive.com.

* The Falcon extortion brand is not known to be connected to CrowdStrike's Falcon platform.