# Google Calendar phishing campaign hijacks sessions, bypasses MFA

DevFeed: [Google Calendar phishing campaign hijacks sessions, bypasses MFA](<https://devfeed.tech/articles/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa-116532.md>)

Original publisher: [Read original article](<https://www.bleepingcomputer.com/news/security/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa/>)

Author: Sponsored by Material Security

Published: 2026-11-04T15:00:10Z

Content type: news

Language: en

Sources: [BleepingComputer](<https://devfeed.tech/sources/bleepingcomputer.md>)

Topics: [Google Calendar](<https://devfeed.tech/topics/google-calendar.md>), [credential-based attacks](<https://devfeed.tech/topics/credential-based-attacks.md>), [Security, Privacy and Abuse Prevention](<https://devfeed.tech/topics/security-privacy-and-abuse-prevention.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [calendar](<https://devfeed.tech/tags/calendar.md>), [calendar-invites](<https://devfeed.tech/tags/calendar-invites.md>), [campaign](<https://devfeed.tech/tags/campaign.md>), [computer-help](<https://devfeed.tech/tags/computer-help.md>), [computer-security](<https://devfeed.tech/tags/computer-security.md>), [computers](<https://devfeed.tech/tags/computers.md>), [corporate](<https://devfeed.tech/tags/corporate.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [domains](<https://devfeed.tech/tags/domains.md>), [fake](<https://devfeed.tech/tags/fake.md>), [google](<https://devfeed.tech/tags/google.md>), [google-calendar](<https://devfeed.tech/tags/google-calendar.md>), [google-workspace](<https://devfeed.tech/tags/google-workspace.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [invites](<https://devfeed.tech/tags/invites.md>), [linux](<https://devfeed.tech/tags/linux.md>), [mac](<https://devfeed.tech/tags/mac.md>), [malicious](<https://devfeed.tech/tags/malicious.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-removal](<https://devfeed.tech/tags/malware-removal.md>), [material](<https://devfeed.tech/tags/material.md>), [material-security](<https://devfeed.tech/tags/material-security.md>), [messages](<https://devfeed.tech/tags/messages.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [operation-cloudfire](<https://devfeed.tech/tags/operation-cloudfire.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [security](<https://devfeed.tech/tags/security.md>), [session-hijack](<https://devfeed.tech/tags/session-hijack.md>), [sessions](<https://devfeed.tech/tags/sessions.md>), [spyware](<https://devfeed.tech/tags/spyware.md>), [support](<https://devfeed.tech/tags/support.md>), [tech-support](<https://devfeed.tech/tags/tech-support.md>), [technical-support](<https://devfeed.tech/tags/technical-support.md>), [virus](<https://devfeed.tech/tags/virus.md>), [virus-removal](<https://devfeed.tech/tags/virus-removal.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

Since mid-August 2026, Operation CloudFire used Google Calendar invites and other trusted links to funnel corporate users through a reverse proxy that relayed real Google sign-in and MFA prompts while capturing live sessions. Google redirects, sometimes Cloudflare Turnstile, and a browser-built credential page made reputation checks and static scanning ineffective. Material Security says its detections blocked over 99% of malicious messages after identification; its broader response combined message intent, link resolution, technical signals, sender relationships, and calendar account history. It also reported URLs to Cloudflare, which added phishing warnings to reported destinations. Across a month, participating customers recorded 68,676 blocked messages and 897 domains taken down; totals exclude customers who did not share data. The group's activity appeared to disperse after shifting toward Drive share invites, but the article says cheap infrastructure and an inactive Microsoft 365 branch leave a possible return or pivot.

## Source excerpt

A phishing campaign used Google Calendar invites, trusted redirects, and fake login pages to hijack corporate Google sessions and bypass MFA protections. Material Security examines how Operation CloudFire tracked the attacks, blocked malicious messages, and helped take down nearly 900 domains used by the attackers. [...]