Threat watch / Campaign
Calendar-invite phishing campaign steals live Google Workspace sessions
Since mid-August, Material Security says, a phishing campaign has used Google Calendar invites and a live proxy in front of the real Google sign-in page to steal signed-in sessions, even when the user types MFA codes. The figures come from Material alone. Google has made no statement.
- Sector
- Many sectors
- Way in
- Phishing, social engineering
- Product or vendor
- Google Workspace
- How it happened
- The victim gets a calendar invite, often from an organization they already know, with a lure such as a voicemail, an RFP or a court summons. The link leads to a live proxy in front of the real Google sign-in page. It relays SMS codes, authenticator codes and Google's number-match prompt to Google as they arrive, so MFA does not stop it. Material says the lure domains looked clean in commercial reputation feeds through mid-September.[1] Checked 8 Nov 2026
- What was stolen
- A live Google session. Material says it reaches mail, Drive and the ability to grant OAuth access in the victim's name. No count of compromised accounts is public.[1] Checked 8 Nov 2026
- Who was impacted
- Corporate users. Material counted 68,676 campaign messages blocked in one month, from 8,570 compromised sender addresses on 6,354 root domains, and took down 897 domains. The totals include only customers who shared data. No victim is named.[1][2] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- Material publishes its research: the campaign has run since mid-August, with calendar invites and a live MFA proxy. It also reports an unfinished Microsoft 365 branch in the code and expects a pivot to it. [1]
- Material reports one month of takedowns under the name Operation CloudFire. BleepingComputer, in a piece sponsored by Material, says the lure themes shifted from calendar invites to Google Drive share invites. [2]
- CloudNews.tech notes that Google has made no statement. It points to a Google admin setting (August 14) that controls which invitations are added to Calendar automatically. [3]