Since October 2025, two threat actor groups, CORDIAL SPIDER and SNARKY SPIDER, have conducted data theft and extortion campaigns targeting enterprise SaaS environments by intercepting credentials and hijacking identity sessions without touching endpoints. Both groups exploit SSO trust chains and identity provider flows to move laterally across connected SaaS applications, deliberately avoiding endpoint detection tools. Organizations relying primarily on EDR solutions face a structural detection gap: these attacks leave no host-based evidence, making credential theft and SaaS data exfiltration nearly invisible to traditional security monitoring.