Cybercrime Groups Using Vishing and SSO Abuse in Rapid SaaS Extortion Attacks

Two cybercrime groups, Cordial Spider (BlackFile, CL-CRI-1116, O-UNC-045, UNC6671) and Snarky Spider (O-UNC-025, UNC6661), are conducting rapid, high-impact attacks within SaaS environments. These groups use vishing (voice phishing) and single sign-on (SSO) abuse techniques to carry out data theft and extortion attacks while leaving minimal forensic traces. The attacks operate almost entirely within cloud-based software-as-a-service platforms, making detection and attribution challenging for security teams.