Google Calendar phishing campaign hijacks sessions, bypasses MFA
Phishers use live reverse proxies on Google sign-in pages to hijack sessions in real time, evading MFA and reputation checks.
Since mid-August 2026, attackers have run reverse proxies in front of Google sign-in pages to hijack live sessions from corporate users. Messages arrive as legitimate Google Calendar invites with benign pretexts like voicemail notifications or RFPs. The operator relays SMS, authenticator codes, and Tap-Yes prompts to Google, allowing full session control while all checks pass. Material Security’s Threat Research team identified the campaign as Operation CloudFire and reported infrastructure to Cloudflare.
Unconfirmed: Attacker identity and specific TTP details remain unnamed.
- Campaign targets Workspace users via Calendar invites
- Reverse proxies relay 2FA and recovery codes
- 99% of messages caught after initial detection
- Sessions grant OAuth access to email and Drive
- Nyasher framework documented publicly since February
Impact: Hijacked sessions grant access to email, Drive, and OAuth grants
- 1.Revoke sessions and OAuth grants promptly
- 2.Review Workspace audit logs
- 3.Report suspicious Calendar invites to Google
- Vendors
- Products
- Google WorkspaceGoogle Calendar
- Organizations
- Material Security’s Threat Research team
From the original article
6 min read at bleepingcomputer.com
A phishing campaign used Google Calendar invites, trusted redirects, and fake login pages to hijack corporate Google sessions and bypass MFA protections. Material Security examines how Operation CloudFire tracked the attacks, blocked malicious messages, and helped take down nearly 900 domains used by the attackers. [...]
By Sponsored by Material Security · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.