Emerging Cybercriminal Groups Exploit SaaS Platforms in Sophisticated Extortion Campaigns Two cybercriminal collectives, Cordial Spider and Snarky Spider, have escalated attacks on cloud-based environments since October 2025, leveraging Software-as-a-Service (SaaS) platforms to conduct data theft and extortion operations. Both groups operate under The Com, a decentralized cybercriminal network known for sharing tools and infrastructure. The primary attack method involves vishing (voice phishing), where threat actors impersonate IT support or service providers to direct victims to fraudulent Single Sign-On (SSO) portals. These spoofed login pages harvest credentials, granting attackers access to enterprise SaaS environments. Once inside, they exfiltrate sensitive data or use it for extortion. A key challenge in countering these threats is the groups’ use of legitimate SaaS platforms for command-and-control operations. By blending malicious activity with trusted cloud services, they evade detection, exploiting encrypted communications and high availability. This tactic mirrors previous campaigns by ShinyHunters, signaling a broader shift toward identity-based attacks as the new security perimeter. The rise of these groups underscores the growing risks of SaaS adoption, where operational efficiency expands the attack surface. Their agility allows them to outpace traditional defenses, complicating attribution and mitigation efforts.