A phishing campaign targeting Google Workspace users is bypassing multi-factor authentication (MFA) by hijacking authenticated sessions through malicious Google Calendar invitations. The attack uses real-time phishing techniques to intercept login credentials and session tokens, allowing cybercriminals to access accounts even after users successfully complete MFA verification.

 

What happened

A phishing campaign targeting corporate Google users has been hijacking authenticated sessions and bypassing multi-factor authentication (MFA) through malicious Google Calendar invitations. The campaign, identified by Material Security's Threat Research team and dubbed Operation CloudFire, has been active since mid-August 2026.

According to a report by BleepingComputer, attackers used seemingly legitimate calendar invitations to trick recipients into visiting fraudulent Google sign-in pages. The invitations often appeared to come from organizations the recipients had previously communicated with. They contained ordinary business-related requests, including voicemail notifications, requests for proposals (RFPs), court summonses, and missed payment notices.

The campaign used compromised email accounts to distribute invitations, making the messages appear more credible. Many of the embedded links also relied on legitimate Google infrastructure, including Google's URL redirector, Google Drive links, and the share.google domain. This allowed the malicious links to evade traditional security tools that rely on domain reputation and URL analysis.

Once a recipient clicked a link, they were directed through a series of redirects and security checks before reaching a fraudulent Google sign-in page. Attackers then captured login credentials and hijacked the victim's authenticated session in real time, allowing them to bypass MFA protections.

 

Going deeper

The campaign relied on a reverse proxy phishing technique that allowed attackers to intercept authentication sessions between victims and Google's legitimate sign-in service. Rather than simply collecting usernames and passwords, the attackers positioned a reverse proxy between the victim and Google. When a user attempted to sign in, the proxy relayed their authentication information to Google's actual sign-in page while simultaneously capturing the resulting authenticated session. This approach allowed attackers to relay MFA verification requests in real time. It supported several authentication methods, including SMS verification codes, authenticator application codes, Google's Tap-Yes number matching, and phone-based account recovery. Consequently, victims could complete what appeared to be a legitimate authentication process without realizing that their sessions were being intercepted.

The campaign also used a three-layer infrastructure designed to evade detection:

  • Google URL redirects: Attackers used Google's legitimate URL redirector to conceal the actual destination of malicious links.
  • Cloudflare Turnstile: A challenge mechanism, sometimes using Cloudflare's genuine Turnstile widget, helped make the malicious infrastructure appear legitimate and prevented automated security scanners from easily accessing the phishing pages.
  • Dynamically generated phishing pages: JavaScript constructed the fraudulent sign-in page directly in the victim's browser after the security challenge. This meant that traditional crawlers and scanning tools could not retrieve a static phishing page for inspection.

The attackers also frequently changed their infrastructure, registering new domains and preparing receiving endpoints shortly before launching phishing campaigns. This made it difficult for security teams to rely on previously identified malicious domains to detect subsequent attacks.

 

In other news

In a similar report in May 2026, Microsoft warned of a large-scale phishing campaign that targeted more than 35,000 users across 13,000 organizations in 26 countries. The campaign, which primarily affected organizations in the United States, used adversary-in-the-middle (AiTM) techniques to bypass traditional MFA protections. Attackers disguised phishing emails as internal workplace communications, using themes such as code of conduct reviews and compliance notices. The messages contained malicious links and attachments that redirected recipients to fraudulent Microsoft sign-in pages.

Using an AiTM technique, attackers intercepted login credentials and authentication tokens in real time, allowing them to capture authenticated sessions even after victims successfully completed MFA verification. The attackers also distributed messages through legitimate email delivery services, making them more difficult for traditional email security systems to detect.

Healthcare, financial services, professional services, and technology organizations were among the affected sectors.

Go deeper: Microsoft warns of a phishing campaign bypassing MFA protections

 

In the know

MFA bypassing and session hijacking are closely related techniques used in account compromise, but they describe different parts of an attack.

MFA bypassing occurs when attackers circumvent the additional identity verification required during login. Rather than breaking the MFA system itself, attackers may use phishing techniques to intercept verification codes or relay authentication requests in real time. This allows them to gain access even when a user successfully completes MFA.

Session hijacking, on the other hand, occurs when attackers steal an authenticated session token or cookie after a user has logged in. Since the token confirms that authentication has already taken place, attackers can use it to access the account without entering the user's credentials or completing MFA again.

The two techniques can be used together. In an adversary-in-the-middle phishing attack, for example, attackers first intercept the login process and relay MFA verification requests. Once the user successfully authenticates, attackers capture the resulting session token and reuse it to access the account.

The key distinction is that MFA bypassing targets the authentication process, while session hijacking targets the authenticated session. Both can undermine account security, which is why organizations should protect not only login credentials but also active sessions.

Organizations can reduce these risks by implementing layered email security solutions alongside MFA. Solutions such as Paubox help protect healthcare organizations against phishing by securing email communications at the gateway level and blocking malicious messages before they reach users' inboxes. Its inbound email security uses advanced threat detection to identify suspicious links, malicious attachments, and impersonation attempts.

 

Why it matters

The campaign points out the limitations of traditional email security measures. Malicious messages can exploit trusted services and compromised accounts to appear legitimate, making domain reputation checks and conventional phishing detection less effective.

 

FAQS

How can users identify malicious Google Calendar invitations?

Users should be cautious of unexpected invitations, unfamiliar senders, urgent requests, and links asking them to sign in or provide sensitive information. They should verify unexpected requests with the sender through a separate communication channel.

 

Does MFA guarantee protection against account compromise?

No. Although MFA makes unauthorized access more difficult, attackers can use techniques such as session hijacking and MFA fatigue to circumvent certain authentication methods. Organizations should combine MFA with email security, access monitoring, and incident response controls.

 

How can email security solutions help prevent phishing attacks?

Email security solutions can identify and block suspicious messages, malicious links, harmful attachments, and impersonation attempts before they reach users' inboxes. These controls reduce employees' exposure to phishing attempts and complement other security measures.