Since October 2025, two financially motivated threat actors, CORDIAL SPIDER and SNARKY SPIDER, have conducted targeted data theft and extortion campaigns by hijacking employee SSO credentials and session tokens through adversary-in-the-middle phishing and voice-based deception. Once inside, attackers move freely across cloud and SaaS environments without ever touching a managed endpoint, bypassing endpoint detection tools entirely. Organizations relying solely on EDR and traditional MFA face significant exposure; the business risk includes data exfiltration, extortion, and potential disruption to any SaaS-dependent business process.