AI Weekly Malaysia

Uber Freight is investigating a data breach claimed by the Helix extortion group, which says it stole nearly 1 million files from mailboxes, OneDrive accounts, and accounts receivable systems. Uber Freight says operations were never disrupted and the incident was contained. Helix is linked by Google Threat Intelligence to a cluster (UNC6671) that uses vishing—posing as IT helpdesk staff—to run device code phishing against employees, then siphons data from Microsoft 365 and Okta.

Why: If your org uses Okta or Microsoft 365, this is a concrete reminder that device code phishing via fake IT helpdesk calls is an active, working attack path—not a theoretical one. Train staff to reject unsolicited device code prompts and verify any 'mandatory security migration' call through an internal channel before entering codes.

This sponsored feature argues that Microsoft's shared responsibility model leaves M365, Entra ID, and Azure customers unprotected against ransomware-driven data deletion, since Microsoft ensures service availability but does not restore data to a known-good point. Brent Torre, described as GM of cyber resilience (vendor not named in excerpt), states Microsoft's native tools handle accidental deletion and governance but are not a backup solution.

Why: If you run SaaS workloads on M365 or Azure, verify whether your team or MSP has a third-party backup that can restore to a point-in-time after ransomware or malicious deletion—Microsoft's native retention is not that. This is a sponsored vendor piece, so treat the framing as marketing and confirm the specific gaps against Microsoft's own documentation rather than taking claims at face value.