Google Calendar Phishing Campaign Hijacks Sessions and Bypasses MFA

A phishing campaign exploiting Google Calendar has been used to hijack corporate Google sessions and bypass multi-factor authentication (MFA) protections, according to analysis by security firm Material Security. The operation, tracked as Operation CloudFire, used calendar invites containing malicious links. When victims interacted with the invites, they were redirected to trusted-looking login pages that captured credentials and session tokens, allowing attackers to bypass MFA protections.

The attackers abused Google's own infrastructure to host malicious content, leveraging trusted redirects that made the phishing pages appear legitimate. Material Security reported that the campaign targeted corporate Google Workspace users globally. Following Material Security's analysis and reporting, nearly 900 domains used by the attackers were taken down, mitigating ongoing risk.

The attack chain begins with a calendar invite sent to a target. The invite contains a link that redirects the victim through a series of trusted-looking domains before reaching a fake Google login page. Because the initial link directs through Google-owned or trusted redirect services, security filters may not flag the final destination as suspicious. Once on the fake login page, victims enter their credentials and, depending on the page design, may unknowingly approve an MFA prompt or have their session token captured, allowing the attacker to gain access without needing to complete MFA a second time.

The exact number of victims is not specified in the report, but the campaign's use of trusted Google infrastructure and social engineering made it particularly effective against corporate environments. Google and Material Security have taken action to block malicious messages and remove attacker infrastructure. The company advises users to verify calendar invite sources, enable phishing protections within Google Workspace, and report suspicious events. No software patch is required; mitigation relies on user awareness and platform-level blocking of malicious domains.