Since October 2025, two financially motivated threat actors, CORDIAL SPIDER and SNARKY SPIDER, have conducted targeted data theft and extortion campaigns against enterprises using SaaS platforms and federated identity providers. Both actors bypass endpoint detection entirely, operating exclusively within trusted SaaS environments after gaining access through voice phishing and credential interception. Organizations relying on MFA alone for SaaS access are exposed, and the business risk includes data exfiltration, extortion, and reputational damage without any traditional malware footprint to detect.