Operation CloudFire Used Calendar Invites to Hijack Google Sessions and Bypass MFA
Summary
Material Security says Operation CloudFire used Google Calendar invites, reverse-proxied sign-in pages, and relayed MFA prompts to capture live Google sessions. Its takedown effort reported 897 domains over one month; activity appears to have dispersed.
Key points
- Material Security says the campaign, active since mid-August 2026, used Calendar invites with familiar pretexts and links that often routed through trusted Google URLs.
- A live reverse proxy relayed passwords and second-factor prompts—including SMS, authenticator codes, Tap-Yes number matching, and account recovery—to capture authenticated sessions.
- The reported chain used a Cloudflare Turnstile challenge and a password-capture page constructed in the browser, which Material says left crawlers with no static page to scan.
- Material attributed the operation to the Nyasher framework, which has been publicly documented since February.
- In a month of Operation CloudFire, Material reported analyzing 2,112 malicious URLs and taking down 897 domains through Cloudflare abuse reports; the figures cover only participating customers.
- Material reported blocking over 99% of malicious messages after building detections, with a 0.01% reclassification rate.
- Material says the campaign's lures shifted toward Google Drive sharing, activity appeared to disperse, and an unfinished Microsoft 365 branch suggests a possible future pivot.
Article Details
- Attack Vectors
- Phishing invitations delivered through Google Calendar used mundane pretexts and links that often began with Google's redirector; other waves used share.google and Drive file links.
- A live reverse proxy presented the genuine Google sign-in page, relayed passwords and MFA challenges to Google in real time, and captured the victim's live session.
- In some builds, a Cloudflare Turnstile challenge preceded a password-capture page that JavaScript constructed in the browser.
- Attackers used compromised sender accounts to send invitations to victims' saved contacts and other recipients.
- Defensive Notes
- Review Workspace audit logs for signs of hijacked sessions, and be prepared to revoke sessions, contain OAuth grants, and reset affected accounts promptly.
- Assess calendar invitations as a threat surface and evaluate technical indicators, message intent, resolved link destinations, and sender relationships together rather than relying on reputation or link analysis alone.
- Material Security reported the campaign's gateway and backend URLs through Cloudflare's abuse reporting system; Cloudflare validated the phishing pages and applied warning interstitials.
MITRE ATT&CK
T1056.003 · Web Portal CaptureA reverse-proxied Google sign-in page captured victims' passwords.T1078.004 · Cloud AccountsThe operator used compromised sender accounts to send phishing invitations to victims and other recipients.T1111 · Multi-Factor Authentication InterceptionThe proxy relayed SMS codes, authenticator codes, Google Tap-Yes number matching, and phone-based account recovery prompts.T1539 · Steal Web Session CookieThe operation captured live Google sessions after victims authenticated through the reverse proxy.T1557 · Adversary-in-the-MiddleThe operator placed a live reverse proxy between victims and the genuine Google sign-in page, relaying authentication traffic in real time.T1566.002 · Spearphishing LinkGoogle Calendar invitations contained links leading recipients toward the phishing flow.
Vendors
Products
Cloudflare TurnstileThe second is a Cloudflare Turnstile challenge, which in some builds is the genuine widget served from Cloudflare’s own infrastructure.Google CalendarGoogle Calendar phishing campaign hijacks sessions, bypasses MFAGoogle DriveThe phishing themes have shifted, from calendar invites to Google Drive file and document share invites.Microsoft 365 Apps for EnterpriseRebuilding the infrastructure is cheap, the framework has been public since February, and the operator shipped an unfinished Microsoft 365 branch alongside the live Google code.