Operation CloudFire: Google Calendar and Drive phishing uses live reverse proxies to hijack Google sessions and bypass MFA
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 12/11/2026 12:00; os links antigos trazem para cá.
Since mid-August 2026, a phishing operation tracked by Material Security as Operation CloudFire has targeted corporate Google users with Google Calendar invites, and later Google Drive share lures, to steal live authenticated sessions and bypass MFA (bleepingcomputer.com). The attackers place a live reverse proxy, built on the Nyasher phishing framework, in front of the genuine Google sign-in page. It captures passwords and second factors in real time, including SMS codes, authenticator codes and Google Tap-Yes prompts (thehackernews.com). The lures abuse legitimate Google URLs, Cloudflare Turnstile challenges and dynamically generated pages, so reputation scoring, link analysis and static scanning miss them. Over one month, Material recorded 68,676 blocked campaign messages, 2,112 malicious URLs, 897 domains taken down and 8,570 compromised sender addresses across 6,354 root domains (bleepingcomputer.com). Material worked with Cloudflare to interdict the malicious infrastructure (thehackernews.com). The most recent report (thehackernews.com, 2026-11-12) warns that the framework may support other brands, such as Microsoft 365, so the technique is likely to persist.
Detalhes técnicos
- Redirectors and lures: The campaign abuses Google's own
/urlredirector,share.googleand Drive links. One variant used Intuit notification links, so every link-reputation signal looks legitimate (bleepingcomputer.com). - Obfuscation layers: There are three. First, the legitimate Google redirector. Second, a Cloudflare Turnstile challenge, which is sometimes genuine. Third, a credential-capture page built in the browser by JavaScript only after the challenge is cleared, leaving nothing static for crawlers or proxies to log (bleepingcomputer.com).
- Session hijacking: The proxy relays the victim's real Google authentication flow, including SMS codes, authenticator codes, Tap-Yes number matching and phone-based recovery. The result is session hijacking rather than simple credential theft. It gives access to mail and Drive and the ability to grant OAuth access (bleepingcomputer.com).
- Infrastructure: Domains are registered days before use and certificates are issued within an hour of registration. This makes single-indicator blocking ineffective (bleepingcomputer.com).
- Compromised senders: Invites are sent from compromised sender addresses to the victims' trusted contacts (bleepingcomputer.com).
- Framework: Nyasher has been publicly documented since February (bleepingcomputer.com).
- Microsoft 365 branch: Material's Threat Research team found an unfinished Microsoft 365 branch in the attacker's framework, including a stylesheet path and a decoded Microsoft sign-in title string (bleepingcomputer.com).
Remediação
- Vendor action already taken: Material reported gateway and backend URLs to Cloudflare's abuse system. Cloudflare applied phishing interstitials to confirmed malicious destinations, which protects all users who click reported links, not only Material customers (bleepingcomputer.com).
- Audit logs: Monitor Workspace audit logs for anomalous session activity (both sources).
- Response speed: Make sure teams can revoke sessions, contain OAuth grants and reset accounts within an hour of detection (bleepingcomputer.com).
- Calendar invites as a threat surface: Analyse invites in context. Do not rely solely on email gateway inspection or reputation-based link analysis (both sources).
Relatos divergentes
- Microsoft 365 scope: bleepingcomputer.com (2026-11-04) describes the Microsoft 365 branch as unfinished and suggests the operator may pivot platforms next. thehackernews.com (2026-11-12) says Nyasher supports other brands such as Microsoft 365. This does not confirm that Microsoft 365 phishing is active in this campaign. The more detailed bleepingcomputer.com account suggests it is not yet operational.
- Volume figures: thehackernews.com gives rounded figures (over 68,000 blocked messages, thousands of compromised senders). bleepingcomputer.com gives the exact counts above, which are the more precise ones.
Linha do tempo
-
Phishing Campaign Using Google Calendar Invites and Live Reverse Proxies Steals Google Sessions
ler a análise desta fonte ocultar
Since August 2026, a sophisticated phishing campaign has been targeting corporate Google users by sending deceptive Google Calendar invites and using live reverse proxies to steal authenticated sessions. The campaign leverages legitimate Google URLs, Cloudflare Turnstile challenges, and dynamically generated pages to evade detection by traditional reputation systems, link analysis, and static scanning. Victims enter credentials on a proxied Google sign-in page; the attacker captures passwords and second factors including SMS codes, authenticator codes, and Google Tap-Yes prompts in real time, enabling complete session hijacking. The infrastructure is disposable, cycling through numerous domains and certificates rapidly to avoid blocking. Material Security's team observed over 68,000 blocked messages, 897 domains taken down, and thousands of compromised sender accounts during Operation CloudFire, which also worked with Cloudflare to interdict malicious infrastructure. The campaign's adaptability and multi-layer evasion emphasize the need for contextual analysis of calendar invites, comprehensive audit log reviews, and rapid incident response capabilities to revoke sessions and contain OAuth threats. Researchers warn that the phishing framework 'Nyasher' supports other brands like Microsoft 365, suggesting this threat vector will persist with evolving tactics.
-
Operation CloudFire: Google Calendar Phishing Campaign Hijacks Live Sessions, Bypasses MFA via Reverse Proxy
ler a análise desta fonte ocultar
Since mid-August 2026, a phishing operation tracked by Material Security as Operation CloudFire has used Google Calendar invites (and later Google Drive share lures) to harvest live Google sessions from corporate users, bypassing MFA entirely. The campaign abuses Google's own
/urlredirector,share.google, Drive links, and in one variant Intuit notification links, so every reputation and link-scoring signal appears legitimate. Attackers run a live reverse proxy (built on the Nyasher phishing framework, publicly documented since February) in front of the genuine Google sign-in page, relaying SMS codes, authenticator codes, Tap-Yes number matching, and phone-based recovery in real time to capture fully authenticated sessions. Infrastructure is highly disposable, with domains registered days before use and certificates issued within an hour of registration, making single-indicator blocking ineffective. Over one month, Material recorded 68,676 blocked campaign messages, 2,112 malicious URLs, 897 domains taken down, and 8,570 compromised sender addresses across 6,354 root domains used to send invites to victims' trusted contacts.Technical Details
The attack chain has three obfuscation layers: Google's legitimate redirector, a Cloudflare Turnstile challenge (sometimes genuine), and a credential-capture page constructed dynamically in the browser via JavaScript only after the challenge is cleared, leaving nothing static for crawlers or proxies to log. A live reverse proxy relays the victim's real Google authentication flow, including MFA approvals, directly to the attacker, resulting in session hijacking rather than simple credential theft — granting access to mail, Drive, and OAuth grant capability. Material's Threat Research team also found an unfinished Microsoft 365 branch in the attacker's framework, including a stylesheet path and a decoded Microsoft sign-in title string, suggesting the operator may pivot platforms next.
Remediation
Material reported gateway and backend URLs to Cloudflare's abuse system, which applied phishing interstitials to confirmed malicious destinations, burning attacker infrastructure and protecting all internet users who clicked reported links, not just Material customers. Defenders are urged to monitor Workspace audit logs for anomalous session activity, ensure teams can revoke sessions, contain OAuth grants, and reset accounts within an hour of detection, and treat calendar invites as a distinct threat surface rather than relying solely on email gateway inspection or reputation-based link analysis.