Sophisticated Criminal Ring Targets Microsoft SharePoint Users Through Social Engineering Tactics

A New Threat Emerges

Security researchers have identified a criminal organization using a deceptive tactic called "vishing" to break into corporate Microsoft SharePoint accounts and steal sensitive business documents. Rather than using technical hacking methods, these attackers are calling employees directly, pretending to be IT support staff or trusted vendors, and convincing them to reveal login credentials or grant access to company files.

The group, known as Helix, has been actively targeting organizations across multiple industries over recent weeks. Once they gain access to SharePoint—the document storage and collaboration system used by millions of companies worldwide—they systematically download confidential files including financial records, strategic plans, and customer information.

What This Means

Think of vishing like a burglar calling your home and convincing you to unlock the door by claiming to be a plumber or electrician. Except instead of stealing physical items, these criminals are taking digital assets that represent real business value and competitive advantage.

SharePoint breaches are particularly concerning because these systems typically contain an organization's most important documents. Unlike a ransomware attack where companies know something has happened, data theft through vishing can go unnoticed for weeks or months. The attackers quietly copy files while leaving the originals intact.

What makes the Helix group notable is their focus on this social engineering approach rather than exploiting software vulnerabilities. This means companies cannot simply patch their systems to stay protected—the human element is the target.

Why You Should Care

If you work in an office environment, you likely use SharePoint or similar cloud storage systems. Your personal information, project details, and business strategies could be at risk. Even if you're not a direct employee, your data may be stored in your employer's SharePoint system without your knowledge.

For business leaders, this threat represents a significant liability. Stolen competitive information can be sold to rivals. Customer data breaches trigger legal obligations and damage to reputation. Financial records in criminal hands can lead to fraud and extortion.

The vishing approach is also scalable and low-cost for attackers. They don't need sophisticated hacking skills—just persuasive communication abilities and persistence.

What You Can Do

• Verify before sharing: If someone calls requesting account information or access, hang up and call your IT department directly using a number you already know. Legitimate IT staff will never ask for your password.
• Question unusual requests: Be suspicious of callers claiming urgency or requesting unusual access. Real IT support can verify their identity through official channels.
• Enable multi-factor authentication: Even if attackers obtain your password, this extra security layer can block unauthorized access to your accounts.
• Report suspicious calls: Inform your security team immediately if someone contacts you with requests that feel off. This helps your organization defend against ongoing attacks.
• Attend security training: Understanding common tactics used by social engineers makes you significantly harder to manipulate.
• Review access logs: Organizations should regularly check who has accessed SharePoint and what files were downloaded, looking for unusual patterns.

The best defense against vishing attacks combines technical protections with employee awareness, since attackers will always target the easiest path into any organization.