Loading threat actor…
Cordial Spider is a financially motivated cybercrime group conducting rapid, SaaS-focused data theft and extortion campaigns. Also tracked as CORDIALSPIDER, PREY-0058, CL-CRI-1116, O-UNC-045, UNC6671, and BlackFile, it emerged in late 2025 and primarily targets U.S. organizations. Its targets include law firms, retail and hospitality businesses, aviation and automotive organizations, financial services companies, technology companies, and academic institutions. It is associated with The Com cybercrime ecosystem but is tracked separately from Snarky Spider, which uses closely similar techniques. The group impersonates internal IT or help-desk personnel through voice phishing, often claiming that employees must update SSO passkeys or authentication settings. Victims are directed to branded adversary-in-the-middle phishing pages that capture credentials, MFA responses, and authenticated session tokens. Cordial Spider replays stolen sessions through residential proxies and abuses identity-provider trust relationships to access connected SaaS applications. Its operations include account and directory reconnaissance, identification of privileged users, and collection of sensitive documents and email from services including Microsoft 365, Google Workspace, SharePoint, OneDrive, Exchange, Box, HubSpot, and Salesforce. Cordial Spider maintains access by manipulating MFA enrollment and registering attacker-controlled authentication devices. It conceals activity by deleting security notifications, creating inbox rules, and routing traffic through VPNs and residential proxies. Its associated Work Panel platform coordinates employee research, caller assignments, branded phishing infrastructure, live authentication workflows, and stolen-credential handling across separate operational roles. Intrusions largely rely on legitimate cloud functionality rather than endpoint malware. Stolen information is used for extortion, with demands commonly reaching seven figures, and the group has operated the BlackFile data-leak site.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
47 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
23 indicators attributed to this actor. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.