Cybercrime Groups Using Vishing and SSO Abuse in Rapid SaaS Extortion Attacks

Two cybercrime groups, Cordial Spider and Snarky Spider, are conducting rapid, high-impact extortion attacks targeting SaaS environments.

• •They use vishing (voice phishing) to direct users to malicious SSO-themed Adversary-in-the-Middle (AiTM) pages that capture authentication credentials.
• •Both groups operate almost exclusively within trusted SaaS environments, minimizing their footprint while accelerating time to impact.
• •Attack procedures include impersonating IT help desk personnel, registering new devices to bypass MFA, and configuring inbox rules to suppress notifications.
• •They target high-privileged accounts by scraping internal employee directories and using elevated access to breach Google Workspace, HubSpot, SharePoint, and Salesforce.
• •