Google Calendar Phishing Campaign Hijacks Sessions and Bypasses MFA

Since mid-August 2026, a phishing campaign has used Google Calendar invitations to steal live Google sessions from corporate users, according to Material Security. The company’s Threat Research team calls the operation Operation CloudFire.

Messages have included voicemail alerts, RFP and RFI requests, court summonses, and missed payment notices. Some were sent from organizations the recipient had previously contacted. Links often led through Google’s own redirector, while other variants used share.google, Drive file links, or Intuit transaction links.

Attackers placed a live reverse proxy in front of the genuine Google sign-in page. Victims entered passwords and approved real authentication prompts while the proxy relayed SMS codes, authenticator codes, Google’s Tap-Yes number matching, and phone-based account recovery. Material says this allowed attackers to capture sessions despite those second-factor checks.

Material says the campaign combined trusted redirects, in some cases a genuine Cloudflare Turnstile challenge, and a password-capture page created in the visitor’s browser. The company reports that it caught over 99% of the malicious messages after building detections, with a 0.01% reclassification rate.

In late September, Material began Operation CloudFire to report the campaign’s infrastructure to Cloudflare. Material says Cloudflare validated the fake interstitial and proxied sign-in page, then applied its own phishing interstitial. The source describes the takedown effort as involving nearly 900 domains.