A phishing operation running since mid-August 2026 is stealing live Google sessions from corporate users, and the defences most organisations rely on to judge a link all come back clean. The operator built the campaign around that outcome.
What happened
Material Security's threat research team documented the activity and has been taking down attacker domains under the name Operation CloudFire, with hundreds removed so far. The lures arrive as Google Calendar invites, some sent by BCC, and many appear to come from an organisation the recipient has already exchanged mail with. The pretexts are deliberately dull: voicemail notifications, RFP and RFI requests, court summonses, missed payment notices.
Most links point at Google itself. The common pattern uses Google's own /url redirector with the real destination hidden in a query parameter, and other waves used share.google and Drive file links the same way. One variant leaned on Intuit transaction notification links. At the point a mail gateway scores the message, the domain, the certificate and the reputation all belong to legitimate providers.
The click lands on a live reverse proxy sitting in front of the genuine Google sign-in page. The victim types a password, receives a real prompt and approves it while the operator watches, and the proxy passes each second factor to Google as it arrives: SMS code, authenticator code, Tap-Yes number matching, even phone-based account recovery. The session that results is valid, because every step was real. The framework behind the proxy, Nyasher, has been publicly documented since February after researchers found a hardcoded key in its JavaScript. A Cloudflare Turnstile layer and a capture page assembled in the browser by JavaScript mean there is no static page for a crawler or a blocklist to inspect.
Who is affected
The campaign targets corporate users on Google infrastructure, but the technique is not Google-specific and the same pattern works against any hosted sign-in page.
- Google Workspace and Gmail users who click through a calendar invite or a shared file link
- Organisations that treat an approved MFA prompt as proof the login was legitimate
- Teams relying on link reputation, domain age or TLS certificates as their main phishing filter
What to do now
Hunt for sessions that were created from an unfamiliar device or location, and revoke them: a stolen session needs no password and no prompt to be reused.
- Review Google Workspace admin audit logs for new sign-ins, new device registrations and OAuth grants from users who report an odd invite
- Revoke affected users' active sessions and force reauthentication rather than only resetting the password
- Shorten session lifetime for mail and drive access, and require reauthentication for high-value actions
- Tell staff that a genuine Google prompt can still belong to an attacker, and that the address bar is the thing to check, not the padlock
What this means for South African businesses
Most SMEs here treat multi-factor authentication as the end of the conversation, and this campaign is a clean demonstration that MFA on its own does not stop session theft. The controls that actually bite are short session lifetimes, conditional access rules and the ability to revoke a session within minutes of a report.
Our read is that the realistic exposure for a South African SME is not the proxy infrastructure but the calendar invite: staff are trained to trust invites because they arrive through a platform the company pays for. A user who clicks is not careless, and an incident response plan that depends on blaming them will fail.
Source: The Hacker News report on the Google session hijacking campaign.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.