Helix Extortion Hit Uber Freight via Helpdesk Vishing

Uber Freight is investigating unauthorized access after the Helix extortion group claimed it stole nearly one million files from company cloud and email repositories. Google-linked research says the broader cluster (UNC6671) commonly gets in by calling employees and posing as IT helpdesk staff running “mandatory security migrations,” then using device-code phishing to capture cloud sessions and steal data from services like Microsoft 365.

Key findings

• Helix listed Uber Freight on its leak site and claimed it stole “nearly 1 million files.”
• Stolen data was claimed to come from “mailboxes, OneDrive accounts, the accounts receivable department, and other repositories.”
• Google tracks related activity as UNC6671 and says operators “often use vishing to gain an initial foothold,” pretending to be IT helpdesk staff running “mandatory security migrations.”
• The described workflow includes calling employees “on their personal phones” and using “device code phishing” to obtain “credentials and authenticated sessions” before stealing data from cloud services like “Microsoft 365.”
• Okta identity infrastructure has also been targeted, per Google’s write-up.

Who’s being targeted

• Commonly targeted roles: All employees, Finance (Accounts Receivable), IT Helpdesk/Service Desk, Identity & Access Management (Okta/M365 admins), Operations/Logistics leadership.
• Affected industries: Transportation/logistics, Technology, Hospitality, Manufacturing, Real estate, Healthcare, Insurance.
• Attack channels: vishing.
• Impersonated: IT helpdesk staff.

Awareness takeaways

• Treat unsolicited “IT helpdesk” calls about mandatory migrations as suspicious and verify using a known internal channel before doing anything.
• Never complete a device-code sign-in (or share any login codes) because it can give attackers a fully authenticated session to company cloud data.
• Assume cloud repositories (mailboxes and OneDrive) are prime targets and reinforce reporting when users notice unusual access or consent prompts.
• Train identity admins to be alert for attempts to compromise identity providers like Okta, since attackers may target centralized login systems.

Red flags to watch for

• Unexpected helpdesk call about a “mandatory” migration
• Caller reaches out via personal phone number
• Pressure to complete a device-code sign-in that grants access