Google Calendar phishing campaign hijacks sessions, bypasses MFA

A sophisticated phishing campaign dubbed Operation CloudFire exploited Google Calendar invites to lure corporate victims into fake login pages. Attackers leveraged trusted Google redirects to evade detection and bypass multi-factor authentication by hijacking authenticated session tokens. The campaign targeted corporate Google accounts, making it particularly dangerous for enterprises relying on Google Workspace. Material Security investigated and tracked the attacks, implementing blocking measures against malicious messages. The operation involved nearly 900 malicious domains that were subsequently taken down. The use of legitimate Google infrastructure made detection significantly harder for traditional security tools.