Material Security identified Operation CloudFire, a campaign active since mid-August 2026 that used Google Calendar invitations to steal corporate Google sessions and bypass multifactor authentication (MFA); it says its response helped remove nearly 900 domains. Invitations carried routine lures, sometimes sent by blind carbon copy or from familiar correspondents, and often routed through Google-owned links, making domain reputation checks look reassuring.
The attackers placed a live relay between victims and Google’s real sign-in page. They passed each password and MFA prompt through to Google, then captured the authenticated session the victim had just approved. MFA can therefore succeed while the attacker gains access to the account and its Google Drive data; a password reset alone may not invalidate a session already stolen.
For teams whose services redirect through trusted domains, a familiar link or successful MFA prompt does not establish that the destination—or resulting session—is safe. Access at the session layer may remain even after the password changes.
Google Calendar phishing campaign hijacks sessions, bypasses MFA
A phishing campaign used Google Calendar invites, trusted redirects, and fake login pages to hijack corporate Google sessions and bypass MFA protections.