Google Session Hijacking Campaign Uses Calendar Invites and Live Proxies
Sophisticated phishing operation bypasses multi-factor authentication using real-time reverse proxy infrastructure.
1Sophisticated Phishing Campaign Emerges
Since mid-August 2026, a persistent phishing operation has targeted corporate users by stealing live Google sessions. The attackers utilized legitimate Google infrastructure, including redirectors and calendar invites, to bypass standard reputation-based security filters. This campaign, dubbed Operation CloudFire, successfully evaded traditional detection methods by appearing as routine business communications.
2Weaponizing Trusted Google Services
The attackers sent calendar invites disguised as mundane notifications like court summons or payment notices. These links utilized Google’s own URL redirector, ensuring the initial hop appeared entirely legitimate. Because the links pointed to trusted domains, security reputation systems failed to flag the messages as malicious, allowing them to reach busy inboxes.
3Bypassing Multi-Factor Authentication
Once a victim clicked a link, they were directed to a live reverse proxy mimicking the Google sign-in page. The attacker captured passwords and second-factor authentication codes in real time, including SMS and number matching. By passing these credentials to Google instantly, the operator maintained full access to the victim's session.
4Dynamic Infrastructure and Evasion
The campaign relied on the Nyasher framework, which builds phishing pages dynamically in the browser using JavaScript. This approach leaves no static site for security crawlers to analyze or record. Attackers frequently rotated domains and certificates, often registering them mere minutes before use to minimize the impact of any single block.
5Multi-Signal Detection Strategy
Researchers discovered that relying on a single security signal was insufficient to stop the campaign. Effective detection required weighing technical indicators alongside the apparent intent of the message and the sender's relationship. By analyzing the full context of calendar invites, security teams could identify anomalies that static reputation systems missed.
6Disrupting Attacker Infrastructure
In late September, researchers shifted tactics to target the attacker's backend infrastructure rather than just individual messages. By reporting gateway URLs to Cloudflare, they triggered phishing warnings that protected users globally. This forced the operator to constantly re-register and re-certify their infrastructure, significantly increasing the cost and effort of operations.
7Blast Radius of Hijacked Sessions
A hijacked session allows attackers to access mail, Drive, and OAuth grants, extending the threat far beyond the initial inbox. Security teams must monitor Google Workspace audit logs closely to identify unauthorized activity. The ability to revoke sessions and reset compromised accounts within an hour is critical to containing such breaches.
8Future Risks and Preparedness
While the Google-focused campaign has scattered, the underlying framework remains a persistent threat. Researchers identified unfinished code for Microsoft 365, suggesting the operator is prepared to pivot brands quickly. Organizations must treat calendar invites as a primary threat surface and ensure their incident response teams are ready for rapid session revocation.