A phishing operation running since mid-August 2026 is stealing live Google sessions from corporate users, and it does not need to break multi-factor authentication to do it. The lure arrives as a calendar invite and the capture happens on a page that mirrors the real Google sign-in while the operator watches.
What happened
The invites use dull, plausible themes: voicemail notifications, RFP and RFI requests, court summonses, missed payment notices. Many are sent by BCC and some appear to come from organisations the recipient already deals with. The links are mostly legitimate Google URLs, using Google's own /url redirector, share.google or Drive file links, so the domain, certificate and reputation on display all look correct at the moment the message is scored.
Clicking through lands on a Cloudflare challenge and then a sign-in page built in memory by script, which leaves nothing for a crawler to fetch. Behind it sits a live proxy in front of the genuine Google login, so the victim enters a password, receives a real prompt and approves it. SMS codes, authenticator codes, Google's Tap-Yes number match and phone-based recovery all work, because the proxy relays each one to Google as it arrives and keeps the resulting session.
Material Security's threat research team took down 897 domains behind the campaign under the name Operation CloudFire. The kit, documented publicly as Nyasher, already contains an unfinished Microsoft 365 branch with a Microsoft sign-in title string, which suggests the same operator intends to pivot.
Who is affected
Google Workspace organisations whose staff accept calendar invites from outside senders, and any Microsoft 365 tenant once that branch is switched on.
- Workspace users who can add or accept external calendar invites by default
- Accounts holding mail, Drive and OAuth consent rights in one session
- Tenants without anyone reading Workspace login and OAuth audit logs
What to do now
If a user approves a Google prompt that followed a calendar invite, treat it as a stolen session and revoke it, not as a password problem. Changing the password alone leaves the attacker's session alive.
- Restrict automatic addition of external calendar invitations for all users in the Workspace admin console
- Review audit logs for new OAuth grants, mailbox rules, forwarding and unfamiliar sign-ins after any report of a suspicious invite
- Revoke the user's sessions and refresh tokens, reset MFA methods and check the device for an infostealer before restoring access
- Shorten session lifetime and reauthentication intervals for privileged accounts
- Tell staff that a genuine Google login page reached from a calendar link proves nothing
What this means for South African businesses
Most South African SMEs that rolled out MFA now assume an approved prompt means safety, and this campaign turns that assumption into the attack itself, which makes the control a formality rather than a defence. A firm of 20 to 200 users is a realistic target here because the operator is running volume, not selection, and small tenants rarely have anyone watching Workspace logs for OAuth grants and new mailbox rules. The blast radius is mail, Drive and the ability to grant access in the victim's name, so the response has to be revocation, not a password reset.
Source: Google Calendar phishing campaign hijacks sessions on BleepingComputer.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.