Google Calendar invite phishing steals live Google Workspace sessions and gets past MFA through a reverse proxy in front of the real Google sign-in (Material Security)

Since mid-August 2026 a phishing operation has been stealing live Google sessions from corporate users (Material Security Threat Research, reported 2026-11-04). The lures arrive as Google Calendar invites, sometimes by BCC and often from an organization the recipient has already written to. Links go through Google's own /url redirector, share.google or Google Drive file links, and in one variant Intuit transaction notification links. After a Cloudflare Turnstile check, a page built in the browser puts a live reverse proxy (the Nyasher framework) in front of the genuine Google sign-in. It relays the password, SMS codes, authenticator codes, Tap-Yes number matching and phone-based recovery, so MFA does not stop the takeover. The stolen session gives access to Gmail, Drive and OAuth grants in the victim's name. Material has taken down hundreds of lure domains through Cloudflare (Operation CloudFire), but new domains are registered days before each wave. Named victims and counts: unknown.