Attackers Deploy AiTM Phishing Pages to Access SharePoint, HubSpot, and Google Workspace

Since October 2025, researchers have tracked two adversary groups (CORDIAL SPIDER and SNARKY SPIDER) conducting high-speed data theft from trusted SaaS environments by using vishing to deliver AiTM SSO phishing, stealing session tokens, manipulating MFA, and rapidly exfiltrating sensitive documents via anonymization services; these campaigns emphasize IdP abuse and visibility gaps in SaaS security.