Since August 2026, a phishing campaign dubbed Operation CloudFire has targeted corporate Google users by sending Google Calendar invites that lead to a live reverse proxy capturing real-time Google sessions, effectively bypassing multi-factor authentication. The attackers used multiple layers, including Google redirectors and Cloudflare challenges, to evade detection and leveraged compromised sender addresses to enhance credibility, while Material Security’s team tracked and disrupted the infrastructure by taking down hundreds of domains. Although the campaign appears to have paused, analysts warn the operator has prepared variants for Microsoft 365, signaling potential future threats using similar tactics.
Google Calendar Phishing Campaign Hijacks Sessions, Bypasses MFA
