In 2023, a threat group called Scattered Spider dismantled two of the largest casino operations in the world. Their attacks on MGM Resorts and Caesars Entertainment ran entirely on social engineering: calling employees on the phone, impersonating IT staff, and working their way into identity systems that gave them access to everything else. The financial damage ran into the hundreds of millions of dollars, and the campaigns became the clearest demonstration on record of what a determined, identity-focused attacker could do to a large enterprise.

In the years since, that playbook has become a template.

CrowdStrike published a report last week tracking two new groups, Cordial Spider and Snarky Spider, that have been running data theft and extortion campaigns against US organizations since at least October 2025. 

Both operate within The Com, the same loosely organized online criminal community that produced Scattered Spider, and both are running a recognizable version of the same approach: voice phishing, fake login pages, and rapid traversal of SaaS environments once inside. CrowdStrike's researchers describe them as "the new generation of Scattered Spider." They are distinct from each other and from Scattered Spider itself, with different tools, operating hours, and infrastructure, but the core exploit is the same. 

According to Unit 42, the extortion demands these groups are generating typically run into seven figures, and they are actively targeting organizations across financial services, retail, hospitality, legal, aviation, technology, and academia.

The entry point, for all of them, is a phone call to someone who works at your organization.

The attack, step by step

The playbook is straightforward, which is precisely what makes it effective. Attackers reach employees via voice calls, text messages, or emails, directing them to phishing pages designed to look exactly like their employer's single sign-on portal or primary identity provider. Once an employee enters their credentials, with MFA tokens also captured in real time through an adversary-in-the-middle technique, the attackers have a valid session and a path forward.

From that initial foothold, the groups move fast. Snarky Spider has been observed beginning data exfiltration in under an hour. The immediate priority once inside is persistence: remove the legitimate MFA device from the compromised account, enroll a new one under attacker control, and delete the warning alerts that would otherwise flag the change to the organization. With that done, the attackers traverse the victim's connected SaaS environment at will, pulling whatever data will generate the most leverage in an extortion demand. 

Organizations that decline to pay organizations that decline to pay face their data being leaked publicly or sold to other threat actors groups as well as DDoS. Snarky Spider has gone further, swatting (sending law enforcement under false pretenses) the personal residences of company employees to escalate coercion.

The gap these groups are designed to find

The attack chain above holds together because of a single structural condition: organizations that treat a valid credential as sufficient proof of identity at the moment of a high-stakes account change. When removing a trusted MFA device or enrolling a new one requires nothing beyond a captured session token, the identity layer that should protect those moments is effectively absent, and that is the opening Cordial and Snarky Spider are walking through.

The distinction that matters here is between authentication and identity verification. Authentication confirms that someone knows a password or possesses a token. Identity verification confirms that the person requesting access is provably the person they claim to be. Organizations that conflate those two things are running on the exact gap these groups are engineered to exploit, and the broader vishing trend suggests the exposure is only growing.

According to Mandiant's M-Trends 2026 report, voice phishing surged to become the second-most common initial infection vector in 2025, appearing in 11% of all incident response investigations. In cloud environments specifically, it was the single most common initial access method, accounting for 23% of cloud intrusions, while traditional email phishing dropped to just 6%. 

Attackers have made a clear calculation: social engineering a person over the phone is easier than bypassing technical controls, and that is where investment in offensive tradecraft has shifted.

What a real identity control looks like at these moments

Closing this gap requires addressing it at the exact point where these attacks pivot from credential theft to account control: the moment someone requests an MFA device change, an account recovery, or executes a high-stakes workflow.

When that moment requires verified identity, a government-issued ID and a real-time biometric match confirmed to be live and untampered, a stolen session token alone cannot satisfy it.

That is the control layer Proof is built to deliver. By requiring verified, human identity at the workflow moments that carry the most risk, and by creating a tamper-evident record of who authorized each action and when, Proof closes the gap between authentication and verification that groups like Cordial and Snarky Spider are designed to find. 

These groups are running Scattered Spider's playbook at scale, and the playbook keeps producing results precisely because so many organizations are still treating credential possession as identity confirmation at the moments that matter most.

Organizations relying on authentication alone to protect sensitive account workflows are running with the same gap these groups are actively looking for.

On May 26, Proof is hosting a live session on exactly this problem. We’ll be walking through how to:

• replace vulnerable knowledge-based questions with cryptographically secure identity proofing
• stop social engineering at the help desk
• build an auditable trail of every access grant, so that verified identity becomes the standard every account recovery request has to meet

Save your seat >

And if you'd like to talk through where account recovery fits into your security posture, you can book time with our team here.