Google Calendar Phishing Steals Corporate Sessions and Bypasses Common MFA Methods

A phishing operation active since mid-August 2026 has targeted corporate Google users with Google Calendar invitations and messages impersonating known contacts to steal authenticated sessions. Attackers use compromised sender accounts, legitimate Google redirectors and Cloudflare Turnstile challenges to funnel victims into a live reverse-proxy phishing flow that captures credentials and sessions, bypassing several common multifactor authentication methods in real time. Dynamically constructed JavaScript phishing pages and frequent domain and certificate rotation help evade automated inspection and reputation-based defenses.

Material Security launched Operation CloudFire to disrupt the infrastructure, reporting 68,676 blocked messages, 2,112 analyzed malicious URLs and 897 domains taken down over one month, alongside reporting malicious endpoints to Cloudflare. Stolen sessions can expose Gmail and Google Drive data and enable unauthorized OAuth grants. Activity reportedly subsided or dispersed, but an unfinished Microsoft 365 branch suggests possible expansion rather than a confirmed end to the threat. Defenders should monitor Google Workspace audit logs for suspicious activity and OAuth grants, and rapidly revoke compromised sessions.