CERT24Google Calendar phishing campaign hijacks sessions and bypasses MFALoading data…
CERT24Threat Observatory
Period

Google Calendar phishing campaign hijacks sessions and bypasses MFA

Since mid-August 2026, a phishing campaign has harvested live Google sessions from corporate users. Attackers sent malicious Google Calendar invites and placed a reverse proxy in front of the genuine Google sign-in page, relaying passwords and second-factor codes in real time. Material Security dubbed the activity Operation CloudFire and reported taking down hundreds of domains used in the campaign.

← Back to intelligence

Google Calendar phishing campaign hijacks sessions and bypasses MFA

Since mid-August 2026, a phishing campaign has harvested live Google sessions from corporate users. Attackers sent malicious Google Calendar invites and placed a reverse proxy in front of the genuine Google sign-in page, relaying passwords and second-factor codes in real time. Material Security dubbed the activity Operation CloudFire and reported taking down hundreds of domains used in the campaign.