Simon AI users - enable MFA for all users. It connects directly into Snowflake but doesn’t require MFA for accounts, has one common login portal and isn’t enabled by default. The portal is all over infostealer logs.
This was the prior problem with Snowflake, which they have since fixed (MFA is mandatory now). Simon AI haven’t done that, and connect to the same data. This was the route into ASOS.