Operation CloudFire: Google Calendar phishing campaign hijacks sessions and bypasses MFA

Since mid-August 2026, a sophisticated phishing operation has been harvesting live Google sessions from corporate users. The operators purposefully designed the attack chain so that every signal defenders usually rely on returned reassuring and legitimate answers.

• Phishing messages arrive as Google Calendar invites utilizing trusted redirects and legitimate services.
• Attackers run a live reverse proxy to capture passwords and multi-factor authentication (MFA) codes in real time.
• The infrastructure relies on Cloudflare Turnstile and browser-constructed dynamic login pages.
• Material Security launched Operation CloudFire, successfully taking down nearly 900 malicious domains.

Attack mechanics and defense evasion

The messages arrive as Google Calendar invites, often sent via BCC from compromised organizations that the recipient has previously corresponded with. Pretexts include voicemail notifications, RFP/RFI requests, court summonses, and missed payment notices. Most links point to Google's own /url redirector, share.google, or Google Drive file links, ensuring that domain reputation checks always return benign results.

In every case, a live reverse proxy runs in front of the genuine Google sign-in page. The victim enters a password and approves the MFA prompt while the operator watches the session in real time. The server relays SMS codes, authenticator tokens, and Tap-Yes prompts to Google as they arrive, completely bypassing all second-factor protections.

Three-layer architecture and Operation CloudFire

The framework utilizes a three-layer masking strategy: the first layer is Google's redirector, the second is a Cloudflare Turnstile challenge, and the third is the password-capture page dynamically constructed by JavaScript in the victim's browser. This leaves crawlers with nothing to scan and logs with nothing to record. The infrastructure is entirely disposable, with domains registered days before use.

Recognizing that traditional rules and machine learning models were insufficient alone, Material Security's Threat Research team launched Operation CloudFire. By analyzing gateway and backend URLs and reporting them through Cloudflare's abuse reporting system, they burned the attacker's infrastructure and forced warnings for any internet user clicking the reported links.

Business implications and security recommendations

The ultimate outcome of this campaign is a hijacked Google Workspace session rather than a simple stolen password, granting access to mail, Drive, and the ability to grant OAuth permissions on behalf of the victim. Organizations must ensure their security teams actively review workspace audit logs and possess the capability to revoke sessions and contain OAuth grants within an hour.