Since August 2026, a sophisticated phishing campaign has been targeting corporate Google sessions, exploiting calendar invites to bypass usual security checks. This operation has been able to evade detection due to its meticulously designed approach, leaving defenders with little to no warning signs.
The Deceptive Strategy
The campaign was first identified by Material Security’s Threat Research team, which has dubbed the effort Operation CloudFire. The attackers use Google Calendar invites as the primary lure, often crafted to appear as mundane communications such as voicemail notifications or payment reminders. These invites are cleverly designed not to stand out in a busy inbox, leveraging the trust recipients place in familiar organizations.
Links within these invites typically redirect through Google’s own /url mechanism, with legitimate-looking URLs masking the malicious intent. The attackers also utilize Google Drive links, and in some cases, Intuit transaction notification links, to further obscure their activities.
Technical Execution with Reverse Proxies
Upon clicking a malicious link, victims are redirected through a live reverse proxy that mimics the Google sign-in page. This proxy captures login credentials and authentication codes in real-time, allowing the attacker to hijack the session completely. The framework behind this, known as Nyasher, has been public knowledge since earlier in the year, making it a widespread threat.
The phishing operation employs a multi-layered approach to avoid detection. It uses Google’s trusted redirector for initial redirection, followed by a Cloudflare Turnstile challenge, and finally, a dynamically generated password capture page. This method ensures that traditional scanning tools and reputation systems are unable to flag the malicious activity promptly.
Countermeasures and Impact
Security teams have been working tirelessly to dismantle this campaign, with efforts focused on identifying and taking down the infrastructure used by attackers. By late September, Material Security began targeting the campaign’s backend URLs, reporting them to Cloudflare for abuse action. This resulted in warnings being placed on malicious links, disrupting the attackers’ operations.
Over a month-long period, Operation CloudFire successfully blocked over 68,000 campaign messages and took down nearly 900 domains. Despite these efforts, the campaign’s ability to mimic legitimate interactions and its low cost of operation make it a persistent threat.
Outlook and Ongoing Threats
While the use of Google Calendar invites has decreased, the attackers have shifted focus to Google Drive file shares. The underlying framework remains adaptable, indicating potential future campaigns could easily pivot to other platforms like Microsoft 365. Security teams are urged to remain vigilant, employing a multi-faceted detection strategy that weighs both technical indicators and the context of communications.
A detailed technical breakdown of the campaign is available in a comprehensive whitepaper, providing a roadmap for organizations to identify and mitigate similar threats in their environments.
