Tag: operation cloudfire

Google Calendar Phishing Campaign Exposes Session Hijacking Tactics

A sneaky phishing campaign, dubbed Operation CloudFire, has been secretly harvesting Google sessions from corporate users since mid-August 2026, using innocent-looking Google Calendar invites to steal passwords and multi-factor interactions in real time. The clever attackers even used legitimate Google links and spoofed emails from trusted organizations to make their scheme seem harmless.