Helix is a new data extortion group that emerged from the BlackFile and ShinyHunters ecosystem. It uses vishing, device code phishing, and MFA abuse to steal data from SharePoint environments, with a tactical split involving separate accounts for exfiltration and extortion messaging.