Google Calendar phishing campaign bypasses MFA, hijacks corporate sessions
Operation CloudFire targeted campaign infrastructure, Material Security reports
Since mid-August 2026, a phishing campaign has used Google Calendar invites to harvest live Google sessions from corporate users, bypassing multi-factor authentication by proxying real Google sign-in pages, cybersecurity firm Material Security has reported.