Attackers Deploy AiTM Phishing Pages to Access SharePoint, HubSpot, and Google Workspace

Cybersecuritynews •Dhivya • May 2, 2026

Threat actors are rapidly shifting their intrusion tradecraft toward high-speed, SaaS-centric attacks that completely bypass traditional endpoint security. Since October 2025, security researchers have tracked two distinct adversaries, identified as CORDIAL SPIDER and SNARKY SPIDER, conducting aggressive data theft campaigns. These groups operate almost exclusively within trusted SaaS environments such as SharePoint, HubSpot, and Google […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Cyber Extortion Groups Target Critical Infrastructure with Phishing Tactics Two threat groups, Cordial Spider and Snarky Spider, affiliated with The Com, are targeting U.S. organizations across various critical infrastructure sectors for rapid data theft and extortion. Their operations, reported by CrowdStrike, began at least in October 2025 and involve sophisticated voice-phishing and social engineering tactics. These attackers exploit vulnerabilities in identity platforms and SaaS environments by tricking employees into providing credentials through fake Single Sign-On (SSO) pages. The groups are linked to the Scattered Spider operation and utilize methods that include disabling multi-factor authentication and deleting alert notifications to cover their tracks. Victims primarily belong to the academic, aviation, retail, hospitality, automotive, financial services, legal, and technology sectors. Extortion demands are typically in the seven-figure range, and some victims face additional DDoS attacks if they refuse to pay. The situation remains critical as the attackers continue to refine their tactics, posing a significant risk to sensitive data and organizational integrity. 5 sources 71

Extracted Entities

Attackers Deploy AiTM Phishing Pages to Access SharePoint, HubSpot, and Google Workspace

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)

Platforms (2)