Two new extortion crews are speedrunning the Scattered Spider playbook

CrowdStrike warns that Cordial Spider and Snarky Spider, financially motivated e-crime subgroups related to Scattered Spider, are conducting widespread voice-phishing and social-engineering campaigns to compromise identity platforms and traverse SaaS environments for rapid data theft and extortion. These actors capture credentials and tokens via phony SSO pages, remove or register MFA devices, erase alerts, and leverage residential proxy networks to evade detection; victims span multiple critical sectors and have faced extortion, DDoS, and harassment including swatting.