Operation CloudFire: Google Calendar Phishing Campaign Hijacks Live Sessions, Bypasses MFA via Reverse Proxy
Since mid-August 2026, a phishing operation tracked by Material Security as Operation CloudFire has used Google Calendar invites (and later Google Drive share lures) to harvest live Google sessions from corporate users, bypassing MFA entirely. The campaign abuses Google's own /url redirector, share.google, Drive links, and in one variant Intuit notification links, so every reputation and link-scoring signal appears legitimate. Attackers run a live reverse proxy (built on the Nyasher phishing framework, publicly documented since February) in front of the genuine Google sign-in page, relaying SMS codes, authenticator codes, Tap-Yes number matching, and phone-based recovery in real time to capture fully authenticated sessions. Infrastructure is highly disposable, with domains registered days before use and certificates issued within an hour of registration, making single-indicator blocking ineffective. Over one month, Material recorded 68,676 blocked campaign messages, 2,112 malicious URLs, 897 domains taken down, and 8,570 compromised sender addresses across 6,354 root domains used to send invites to victims' trusted contacts.
Detalhes técnicos
The attack chain has three obfuscation layers: Google's legitimate redirector, a Cloudflare Turnstile challenge (sometimes genuine), and a credential-capture page constructed dynamically in the browser via JavaScript only after the challenge is cleared, leaving nothing static for crawlers or proxies to log. A live reverse proxy relays the victim's real Google authentication flow, including MFA approvals, directly to the attacker, resulting in session hijacking rather than simple credential theft — granting access to mail, Drive, and OAuth grant capability. Material's Threat Research team also found an unfinished Microsoft 365 branch in the attacker's framework, including a stylesheet path and a decoded Microsoft sign-in title string, suggesting the operator may pivot platforms next.
Remediação
Material reported gateway and backend URLs to Cloudflare's abuse system, which applied phishing interstitials to confirmed malicious destinations, burning attacker infrastructure and protecting all internet users who clicked reported links, not just Material customers. Defenders are urged to monitor Workspace audit logs for anomalous session activity, ensure teams can revoke sessions, contain OAuth grants, and reset accounts within an hour of detection, and treat calendar invites as a distinct threat surface rather than relying solely on email gateway inspection or reputation-based link analysis.
Linha do tempo
-
Operation CloudFire: Google Calendar Phishing Campaign Hijacks Live Sessions, Bypasses MFA via Reverse Proxy
ler a análise desta fonte ocultar
Since mid-August 2026, a phishing operation tracked by Material Security as Operation CloudFire has used Google Calendar invites (and later Google Drive share lures) to harvest live Google sessions from corporate users, bypassing MFA entirely. The campaign abuses Google's own
/urlredirector,share.google, Drive links, and in one variant Intuit notification links, so every reputation and link-scoring signal appears legitimate. Attackers run a live reverse proxy (built on the Nyasher phishing framework, publicly documented since February) in front of the genuine Google sign-in page, relaying SMS codes, authenticator codes, Tap-Yes number matching, and phone-based recovery in real time to capture fully authenticated sessions. Infrastructure is highly disposable, with domains registered days before use and certificates issued within an hour of registration, making single-indicator blocking ineffective. Over one month, Material recorded 68,676 blocked campaign messages, 2,112 malicious URLs, 897 domains taken down, and 8,570 compromised sender addresses across 6,354 root domains used to send invites to victims' trusted contacts.Technical Details
The attack chain has three obfuscation layers: Google's legitimate redirector, a Cloudflare Turnstile challenge (sometimes genuine), and a credential-capture page constructed dynamically in the browser via JavaScript only after the challenge is cleared, leaving nothing static for crawlers or proxies to log. A live reverse proxy relays the victim's real Google authentication flow, including MFA approvals, directly to the attacker, resulting in session hijacking rather than simple credential theft — granting access to mail, Drive, and OAuth grant capability. Material's Threat Research team also found an unfinished Microsoft 365 branch in the attacker's framework, including a stylesheet path and a decoded Microsoft sign-in title string, suggesting the operator may pivot platforms next.
Remediation
Material reported gateway and backend URLs to Cloudflare's abuse system, which applied phishing interstitials to confirmed malicious destinations, burning attacker infrastructure and protecting all internet users who clicked reported links, not just Material customers. Defenders are urged to monitor Workspace audit logs for anomalous session activity, ensure teams can revoke sessions, contain OAuth grants, and reset accounts within an hour of detection, and treat calendar invites as a distinct threat surface rather than relying solely on email gateway inspection or reputation-based link analysis.