AiTM Login Pages Fuel Attacks on SharePoint, HubSpot, and Google Workspace

This report describes active, high-speed data theft and extortion campaigns by two adversary groups (CORDIAL SPIDER and SNARKY SPIDER) that target SaaS environments (SharePoint, HubSpot, Google Workspace) using vishing and AiTM phishing to capture session tokens, manipulate MFA, and rapidly exfiltrate sensitive corporate data—often within an hour—while leveraging residential proxies and VPNs to evade detection.