High-Speed SaaS Extortion: How Cordial Spider and Snarky Spider Abuse SSO

Cybercrime Groups Using Vishing and SSO Abuse in Rapid SaaS Extortion Attacks

Threat clusters Cordial Spider and Snarky Spider are executing rapid, high-impact data theft campaigns by operating almost exclusively within trusted SaaS environments. Snarky Spider has been observed initiating data exfiltration in less than one hour after initial compromise.

Why This Matters

Traditional security models often rely on application-specific MFA, but these adversaries bypass these controls by targeting Identity Providers (IdP) directly. By compromising the SSO entry point, attackers move laterally across an entire SaaS ecosystem—including Google Workspace, Salesforce, and SharePoint—without needing to breach individual applications. This shift to SaaS-native activity minimizes the forensic footprint on endpoints and renders many traditional perimeter-based detection tools ineffective against high-speed extortion.

Key Insights

• Snarky Spider (UNC6661) initiates data exfiltration in under an hour from initial access, as reported by CrowdStrike in 2026.
• Attackers utilize Adversary-in-the-Middle (AiTM) pages to capture authentication data and bypass MFA via new device registration.
• CL-CRI-1116 has specifically targeted the retail and hospitality sectors since February 2026 using vishing and IT help desk impersonation.
• Threat actors use residential proxies to conceal geographic locations and bypass IP-based reputation filters, according to Unit 42 (2026).
• Adversaries suppress automated email notifications by configuring inbox rules that automatically delete messages regarding unauthorized device registration.

Practical Applications

• Identity Provider (IdP) Monitoring: Organizations should implement alerts for the registration of new devices followed immediately by the creation of inbox rules for message deletion. Pitfall: Treating device registration and inbox rule changes as isolated events, which allows attackers to maintain stealth.
• IT Help Desk Protocols: Retail and hospitality firms must implement out-of-band verification for password resets to counter vishing. Pitfall: Relying on internal employee directories for identity verification, which attackers scrape to enhance social engineering credibility.

References:

• http://thehackernews.com/2026/05/cybercrime-groups-using-vishing-and-sso.html