New Phone Scam Targets Business File Storage to Steal Company Data

A new cybercrime group called Helix has emerged using phone calls and text messages to trick employees into giving away access to their company files. They are specifically targeting SharePoint, which is a business file storage system that many companies use to share documents among employees.

The scammers call employees pretending to be from IT support or security teams. They use voice phishing, also called vishing, to manipulate people into providing login codes or approving access requests on their phones. Once they gain access, they steal company data and threaten to release it unless the company pays.

This threat primarily affects people at their workplace rather than at home. If you or someone in your family works for a company that uses SharePoint or Microsoft 365 for work files, they could receive one of these scam calls. The scammers are particularly good at bypassing multi-factor authentication, which is the security feature that sends a code to your phone when you log in.

They trick employees into reading those codes out loud during the fake support call, or into approving login requests that are actually the attacker trying to get in.

1. Do not give out any codes, passwords, or approve any login requests during the call.
2. Hang up and contact your IT department directly using a phone number you look up yourself, not one the caller provides.
3. Never approve authentication requests on your phone unless you personally just tried to log into something.
4. Be especially suspicious of urgent requests or threats like "your account will be locked" or "we detected suspicious activity."
5. Report the call to your workplace IT or security team right away. This scam is a reminder to always verify before you trust. Legitimate IT staff will never pressure you to provide codes or approve requests immediately over the phone. Teach everyone in your family that it is always okay to hang up and call back through official channels when something feels rushed or suspicious. This applies to calls about bank accounts, tech support, or any other sensitive topics. Taking two extra minutes to verify can prevent a major security breach.