A phishing operation active since mid-August 2026 has been harvesting live Google sessions from corporate users by hiding behind Google Calendar invitations, according to research from Material Security's Threat Research team. The campaign, dubbed Operation CloudFire, was described in an account published by BleepingComputer as sponsored content with Material as author, and covered by SC Media on 4 November.

How the invites worked

The lures arrived as Google Calendar invitations, sometimes sent by BCC and often from organisations the recipient already dealt with, using pretexts such as voicemail notices, requests for proposals, court summonses and missed payments. Links ran through Google's own redirector, share.google links or Drive file links, then a Cloudflare Turnstile challenge, before landing on a live reverse proxy of the real Google sign-in page. The victim saw genuine Google prompts and completed them normally — including multi-factor authentication — while the operator relayed passwords, SMS and authenticator codes, number-matching prompts and phone-based recovery to Google in real time, then kept the resulting session.

Why MFA did not stop it

The attack is an adversary-in-the-middle technique: the phishing page is a relay, not a copy of the sign-in page, so the second factor works as designed and the attacker simply keeps the session it produces. From there, Material says, the operator could reach Gmail and Drive and grant OAuth access in the victim's name. The underlying framework, called Nyasher, has been publicly documented since February 2026. Because the links used legitimate Google addresses and domains that came back clean in reputation feeds, traditional filters largely missed them.

Scale and status

Material's figures, drawn only from customers who shared data for one month, count 68,676 campaign messages blocked, 2,112 unique malicious URLs, 897 domains taken down and 8,570 compromised sender addresses across 6,354 root domains. By its 28 October update, Material said the lure theme had shifted from Calendar invites to Google Drive share invites, the campaign appeared to have dispersed, and an unfinished Microsoft 365 branch had been found in the operator's code — a possible pivot, not an active attack.