Two financially motivated cybercrime groups are actively combining phone-based social engineering with session-hijacking infrastructure to compromise corporate identity providers and drain connected SaaS environments, including Google Workspace, Microsoft SharePoint, HubSpot, and Salesforce, within a single authenticated session. Attackers bypass multi-factor authentication entirely by stealing live session tokens, not passwords, leaving minimal forensic evidence because no malware touches endpoints. Organizations relying on traditional endpoint and network controls are effectively blind to this attack; data exfiltration can begin in under 60 minutes from first contact with an employee.