Since mid-August 2026, a phishing campaign has used Google Calendar invites to harvest live Google sessions from corporate users, bypassing multi-factor authentication by proxying real Google sign-in pages, cybersecurity firm Material Security has reported.
The campaign, dubbed Operation CloudFire by Material Security's Threat Research team, sent messages appearing as calendar invites from compromised accounts, often from organizations recipients had already corresponded with. Pretexts included voicemail notifications, court summonses, and missed payment notices. Links typically used Google's own URL redirector, while other waves used share.google and Drive file links. The chain included a Cloudflare Turnstile challenge and a password-capture page constructed dynamically in the browser; in some builds, the challenge was the genuine widget served from Cloudflare's infrastructure. The setup returned reassuring results from reputation checks and left crawlers with no page to fetch.
At the core of the attack was a reverse proxy, using the publicly documented Nyasher framework, that relayed credentials and MFA codes to the real Google sign-in page in real time. This allowed the operator to capture the session despite the second-factor controls.
Material Security said it caught over 99% of the malicious messages since identifying the campaign and building detections, with a reclassification rate of 0.01%. In late September, the company launched Operation CloudFire to target the attacker's infrastructure, reporting gateway and backend URLs to Cloudflare, which applied phishing interstitials to those destinations. Over one month, Material recorded 68,676 campaign messages blocked, 897 unique domains taken down, and 8,570 unique compromised sender addresses across 6,354 root domains. The figures came only from customers who agreed to share data.
The campaign has shifted from calendar invites to Google Drive file and document share invites, and activity appears to have dispersed. However, Material Security said the framework includes an unfinished Microsoft 365 branch, and the operator has built the follow-on without activating it. The company expects the next pivot to look much like this one, but with a different brand.
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.
Campaign activity over one month, by type
Source: Material Security (via BleepingComputer)
§
Analysis
Why This Matters
The campaign demonstrates how attackers can bypass multi-factor authentication by capturing sessions in real time, undermining a key security control.
The use of trusted domains and dynamic page construction makes detection difficult for conventional email security tools that rely on reputation and link analysis.
Infrastructure takedown efforts by security firms can disrupt campaigns, but rebuilding is cheap, indicating a persistent threat.
Background
The Nyasher framework used in the attack has been publicly documented since February 2026. Phishing campaigns increasingly employ adversary-in-the-middle techniques that proxy authentication requests, allowing attackers to harvest session cookies rather than just passwords.
What to Watch
Whether the operator activates the Microsoft 365 branch of the framework, which would indicate an expansion of the campaign.
The speed at which new domains and certificates are registered following takedowns, as a measure of the attacker's resilience.
Adoption of session-based security monitoring and automated response capabilities by enterprises to detect similar attacks.
11 claims in this story checked against 1 source: 11 supported.
Show each claim
SupportedThe campaign hijacked corporate Google sessions.BleepingComputer: “Since mid-August 2026, a phishing operation has been harvesting live Google sessions from corporate users.”
SupportedThe campaign bypassed multi-factor authentication.BleepingComputer: “The server relays SMS codes, authenticator codes, Google’s Tap-Yes number matching, and phone-based account recovery to Google as each one arrives, so none of the second-factor controls stop the session from being captured.”
SupportedMaterial Security’s Operation CloudFire targeted the attackers’ infrastructure.BleepingComputer: “Material’s Threat Research team therefore launched Operation CloudFire to target the infrastructure itself.”
SupportedThe campaign had been harvesting live Google sessions since mid-August 2026.BleepingComputer: “Since mid-August 2026, a phishing operation has been harvesting live Google sessions from corporate users.”
SupportedA reverse proxy relayed credentials and MFA codes to Google in real time, allowing session capture despite second-factor controls.BleepingComputer: “The victim enters a password, receives a real prompt, and approves it, all while the operator watches the session in real time. The server relays SMS codes, authenticator codes, Google’s Tap-Yes number matching, and phone-based account recovery to Google as each one arrives, so none of the second-factor controls stop the session from being captured.”
SupportedMaterial said it caught over 99% of malicious messages after identifying the campaign and building detections.BleepingComputer: “Since August, once the campaign was identified and detections built, Material has caught over 99% of the malicious messages, with a reclassification rate of 0.01%.”
SupportedMaterial reported a reclassification rate of 0.01%.BleepingComputer: “Since August, once the campaign was identified and detections built, Material has caught over 99% of the malicious messages, with a reclassification rate of 0.01%.”
SupportedMaterial reported gateway and backend URLs to Cloudflare, which applied phishing interstitials to those destinations.BleepingComputer: “The team analyzed the gateway and backend URLs as the messages were being sent and reported them through Cloudflare’s abuse reporting system. Cloudflare’s abuse team validated the fake interstitial and the proxied Google sign-in page behind it, then applied its own phishing interstitial to those destinations.”
SupportedOver one month, Material recorded 68,676 campaign messages blocked.BleepingComputer: “Over a month of Operation CloudFire, Material recorded: 68,676 campaign messages blocked”
SupportedOver one month, Material recorded 897 unique domains taken down.BleepingComputer: “897 unique domains taken down”
SupportedMaterial recorded 8,570 unique compromised sender addresses across 6,354 root domains.BleepingComputer: “8,570 unique compromised sender addresses across 6,354 root domains”
