Material Security exposes Google Calendar phishing campaign

Security researchers from Material Security have exposed a calendar-based phishing campaign that has been stealing live Google sessions from corporate users since mid‑August 2026. The operation, dubbed Operation CloudFire, uses Google Calendar invites as the lure, with messages often appearing to come from familiar contacts and containing innocuous pretexts such as voicemail notices, RFPs, or payment reminders.

The URLs funnel through Google’s own redirector, with the real destination tucked into a query parameter; some variants use share[.]google or Drive links, and one variant even leverages an Intuit transaction notification. The usual domain reputation checks appear clean to deceive automated screening.

The capture mechanism relies on a live reverse proxy placed in front of Google’s sign‑in page. When victims enter credentials, they proceed to a genuine Google prompt and any second‑factor input is relayed in real time to the attacker, allowing session takeover. The threat framework behind this, Nyasher, has been publicly documented since February after researchers found a hardcoded key in its JavaScript.

Defence and takedown efforts have blocked thousands of malicious messages and taken down hundreds of attacker domains; Cloudflare’s abuse system was used to warn users and burn the attacker’s infrastructure. Over one month, Material Security reports 68,676 messages blocked, 2,112 unique malicious URLs analysed, 897 domains taken down and 8,570 compromised sender addresses across 6,354 root domains. The full technical breakdown and indicators of compromise are in a companion whitepaper.