Google Calendar phishing campaign hijacks sessions, bypasses MFA

What it is

Operation CloudFire is Material Security's name for a phishing campaign active since mid-August 2026 that harvests live Google sessions from corporate users. The page is sponsored and written by Material, a vendor of email security for Google Workspace and Microsoft 365. Its detection rate (over 99% caught, 0.01% reclassified) is the vendor's own claim.

How it works

Lures are Google Calendar invites, sometimes sent by BCC and often from an organization the recipient already deals with. Pretexts include voicemail notices, RFP/RFI requests, court summonses and missed payments. Most links go through Google's /url redirector with the real destination in a query parameter. Other waves used share.google and Drive file links, and one variant used Intuit transaction notification links.

The chain has three layers:

1. Google's redirector.
2. A Cloudflare Turnstile challenge, in some builds the genuine widget served from Cloudflare.
3. A password-capture page built in the browser by JavaScript after the challenge is cleared. A crawler has nothing to fetch and a proxy log has nothing to record.

Behind this sits a live reverse proxy in front of the real Google sign-in page, built on the Nyasher framework (publicly documented since February 2026, after a hardcoded key was found in its JavaScript). It relays SMS codes, authenticator codes, Tap-Yes number matching and phone-based recovery as they arrive, so the operator captures the session.

Trust in senders comes from compromise: 8,570 compromised sender addresses across 6,354 root domains, each controlled before the first invite, sending to the victim's saved contacts. Lure domains were mostly registered days before use, and endpoints were staged 1 to 20 days ahead. One wildcard certificate was issued 46 minutes before its domain was registered. Reputation checks therefore returned benign results.

flowchart LR
  A[Calendar invite from known sender] --> B[Google redirector]
  B --> C[Turnstile gate]
  C --> D[JS-built sign-in page]
  D --> E[Reverse proxy to real Google]
  E --> F[MFA relayed, session captured]

What to do

The page's advice is mostly organizational:

• Treat calendar invites as a threat surface, since gateways built for mail in transit fit them poorly.
• Score several signals together: technical indicators, message intent, where links actually resolve, and the sending relationship and account history. Reputation or link analysis alone would not have caught this.
• Review Workspace audit logs, where a hijacked session leaves evidence. A live session reaches mail, Drive and OAuth grants.
• Check that your team can revoke sessions, contain OAuth grants and reset the affected account within an hour.
• Report gateway and backend URLs to Cloudflare's abuse system. Cloudflare validated the reports and applied its phishing interstitial, which forced the operator to re-register and re-certify, and warned any visitor.
• For hunting indicators and a timeline, the page points to Material's companion whitepaper. No indicators are on the page.

Caveats

• One month of figures from data-sharing customers only: 68,676 messages blocked, 2,112 unique malicious URLs, 897 domains taken down. Material says true totals are higher.
• Themes have shifted to Google Drive file and document share invites, and activity appears dispersed. Material calls the campaign apparently finished but expects iteration.
• The operator shipped an unfinished Microsoft 365 branch (stylesheet path, second harness, a title string decoding to a Microsoft sign-in prompt). None of its paths resolve today, and activating it needs a dropped-in file, not code changes. Material expects the next pivot to look similar with a different brand.
• The page does not say whether phishing-resistant MFA would stop the relay.