Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign

Material Security's Threat Research team has uncovered a sophisticated phishing campaign that has been active since mid-August 2026. This operation, dubbed Operation CloudFire by the researchers, targets corporate users by stealing live Google sessions through cleverly disguised phishing emails. The campaign's success lies in its ability to bypass traditional security checks, presenting a significant challenge for defenders.

The phishing emails arrive as Google Calendar invites, often sent via BCC, and appear to come from organizations the recipients have previously communicated with. The content of these invites is deliberately mundane, including themes like voicemail notifications, RFP requests, and court summonses, which blend seamlessly into a busy inbox. The links within these emails often redirect through Google's own URL redirector, making them appear legitimate to both users and reputation systems.

Once a victim clicks on the link, they are directed to a live reverse proxy of the Google sign-in page. Here, the attackers capture login credentials in real-time. The proxy passes each authentication factor, such as SMS codes or authenticator codes, directly to Google, allowing the attackers to hijack the session without triggering alerts. This technique effectively neutralizes traditional multi-factor authentication methods.

The infrastructure supporting this campaign is designed for rapid deployment and disposal. Domains are registered shortly before use, and certificates can be issued just minutes before a domain goes live. This agility allows the attackers to quickly replace any component that gets detected and blocked, minimizing downtime and maintaining the operation's momentum.

Material Security's researchers have been actively tracking and disrupting this campaign. They have taken down hundreds of malicious domains and reported them through Cloudflare's abuse system. Cloudflare has responded by placing phishing warnings on these links, effectively burning the attacker's infrastructure and protecting users beyond Material Security's customer base.

Material Security's approach involves analyzing technical indicators alongside message intent and sender relationships. This multi-faceted strategy has proven effective in catching over 99% of the malicious messages, despite the attackers' efforts to evade detection.

The campaign's impact extends beyond email accounts, as hijacked sessions can access Google Workspace, including mail and Drive, and grant OAuth permissions. This broad access poses significant risks, prompting questions about how quickly security teams can respond to such breaches. Material Security's efforts to dismantle the infrastructure aim to prevent future waves and protect a wider audience.