Since mid‑August 2026 a phishing operation has been quietly harvesting live Google sessions from corporate users, capturing passwords and full multi‑factor interactions in real time while presenting every defensive signal as benign.
Google Calendar invites and trusted redirects as the lure
Material Security’s Threat Research team tracked the campaign — dubbed Operation CloudFire — which delivered phishing messages predominantly as Google Calendar invites. The pretexts were ordinary: voicemail notifications, RFP and RFI requests, court summonses and missed‑payment notices. Messages were sometimes sent by BCC and frequently appeared to come from organizations the recipients had already corresponded with.
Most links initially pointed to Google itself. The typical pattern used Google’s /url redirector with the final destination in a query parameter; other waves used share.google and Drive file links, and one variant used Intuit transaction notification links. Because the first hop was a Google URL and the receiving page was built in the browser, reputation and link scanners frequently returned a reassuring result.
Nyasher reverse proxy: how sessions were captured
The operator ran a live reverse proxy in front of a genuine Google sign‑in page. Victims entered passwords, received real prompts, and approved multi‑factor challenges while the operator observed the session in real time. The proxy relayed SMS codes, authenticator codes, Google’s Tap‑Yes number matching, and phone‑based account recovery responses to Google as each factor arrived, so second‑factor controls failed to stop the capture.
Material notes the framework behind this—Nyasher—has been publicly documented since February, after a hardcoded key was found in its JavaScript.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhy reputation systems and crawlers missed it
The campaign was intentionally constructed to return benign answers to ownership and reputation checks. It layered three elements that stymied common defenses: first, a Google redirector; second, a Cloudflare Turnstile challenge (in some builds the genuine widget served from Cloudflare infrastructure); and third, a password‑capture page created on the fly by JavaScript after the challenge is cleared.
Because the final page had no static URL and was constructed in the browser, crawlers had nothing to fetch and proxy logs often showed no observable payload. The infrastructure was disposable by design: many lure domains were registered only days before use, receiving endpoints were staged one to twenty days ahead, and one wildcard certificate was issued 46 minutes before the domain it covered was registered. Blocking any single component forced only a small operational cost to the attacker.
Material Security’s Operation CloudFire and remediation outcomes
Material concluded that tuning detection rules alone would not stop the operator, and it launched Operation CloudFire to target the infrastructure backing the waves. The team analyzed gateway and backend URLs as they were being sent and reported them through Cloudflare’s abuse reporting system. Cloudflare validated the fake interstitials and the proxied Google sign‑in pages and applied its own phishing interstitial to those destinations.
That action 'burned' the attacker’s infrastructure: each reported gateway and receiving endpoint had to be re‑registered, re‑pointed, and re‑certified before the operator could send again, and anyone who clicked a reported link saw a warning rather than a credential form.
- Over one month of Operation CloudFire (Material customers who shared data): 68,676 campaign messages blocked
- 2,112 unique malicious URLs analyzed
- 897 unique domains taken down
- 8,570 unique compromised sender addresses across 6,354 root domains
- Send cadence that followed US business hours
After detections were built, Material says it caught over 99% of the malicious messages with a reclassification rate of 0.01%. The company emphasizes that effective detection combined technical indicators, intent analysis, link resolution and the sending relationship rather than relying on a single signal.
How Workspace administrators, procurement leaders, and end users should respond
- Workspace administrators: examine Workspace audit logs for evidence of live session hijacks, and verify who reviews those logs and how quickly sessions, OAuth grants and accounts can be revoked—Material recommends the ability to contain and reset affected accounts within an hour because a live session can reach mail, Drive and grant OAuth access.
- Procurement and security teams: treat calendar invites and file‑share notifications as a threat surface. Material found calendar invites can evade gateways built to inspect mail in transit, so detection that uses an account’s full history and contextual signals is necessary.
- End users and defenders: be aware that links that initially resolve through trusted services (Google redirectors, Drive, share.google) can still lead to browser‑constructed credential harvesters that relays multi‑factor challenges in real time.
Where things stand: activity tied to the Google‑focused waves has dispersed and the campaign currently looks finished, according to Material. That is not a verdict of permanence. The operator shipped an unfinished Microsoft 365 branch alongside the live Google code; the Microsoft paths do not resolve today, but the branch requires only a file drop to activate. Material reads rotation of themes as iteration, not retirement, and expects future pivots to resemble this campaign with different brands.
For defenders the immediate tasks are clear and practical: treat calendar invites as inbox‑adjacent attack vectors, watch Workspace audit logs closely, ensure teams can revoke sessions and OAuth grants rapidly, and be ready for the same proxying technique to appear under other brands.
Source: BleepingComputer — Google Calendar phishing campaign hijacks sessions, bypasses MFA
