A phishing campaign that began in mid-August 2026 used Google Calendar invitations to steal live sessions from corporate users, according to Material Security. The attackers placed a reverse proxy in front of Google’s genuine sign-in page, allowing them to capture sessions even when victims completed multi-factor authentication (MFA).

The invitations used routine pretexts, including voicemail notifications, RFP and RFI requests, court summonses and missed-payment notices. Some came from organizations recipients had previously contacted, and many were sent from compromised accounts to their owners’ saved contacts.

Links often led first to Google’s own redirect service, with other versions using share.google or Google Drive links. Material also observed a variant involving Intuit transaction notifications. Because the visible domains and certificates belonged to legitimate services, reputation checks could appear reassuring.

After a victim followed the link, a live proxy relayed the sign-in process to Google. The attackers could observe the session as the victim entered a password and approved prompts. Material says the setup also relayed SMS and authenticator codes, Google’s Tap-Yes number-matching prompt, and phone-based account recovery, allowing the session to be captured despite those checks.

The campaign used a three-stage chain: a Google redirect, a Cloudflare Turnstile challenge and a credential-capture page built in the visitor’s browser after the challenge. Material said the page had no static site for a crawler to inspect. The operation used numerous recently registered domains and rotating receiving endpoints, making individual components inexpensive to replace when blocked.

Material’s Threat Research team tracked the activity and named it Operation CloudFire. The company says its detections caught more than 99% of the malicious messages since the campaign was identified, with a 0.01% reclassification rate. Its analysis combined technical indicators with message intent, link destinations and the sender’s relationship with the recipient.

In late September, Material began reporting the campaign’s gateway and backend URLs to Cloudflare. After validating the fake interstitial and proxied sign-in page, Cloudflare added phishing warnings to reported destinations. Material says this disrupted the infrastructure and meant that people who followed reported links could see a warning instead of a credential form.

Across one month, among customers who agreed to share data, Material recorded 68,676 blocked campaign messages, 2,112 unique malicious URLs and 897 domains taken down. It also counted 8,570 compromised sender addresses across 6,354 root domains. The company noted that these figures do not represent the campaign’s full reach.

Material says the lures later shifted from calendar invitations to Google Drive file and document-sharing invitations, while activity from the group appeared to disperse. The company described the campaign as seemingly finished but cautioned that its infrastructure is cheap to rebuild. Its analysis also found an unfinished Microsoft 365 branch in the attacker’s framework, though those paths were not active.

Sources: BleepingComputer.