{"id":"CMP-202611-o3b72k","kind":"campaign","aliases":[],"related":[],"title":"Google Calendar invite phishing steals live Google Workspace sessions and gets past MFA through a reverse proxy in front of the real Google sign-in (Material Security)","description":null,"summary":"Since mid-August 2026 a phishing operation has been stealing live Google sessions from corporate users (Material Security Threat Research, reported 2026-11-04). The lures arrive as Google Calendar invites, sometimes by BCC and often from an organization the recipient has already written to. Links go through Google's own /url redirector, share.google or Google Drive file links, and in one variant Intuit transaction notification links. After a Cloudflare Turnstile check, a page built in the browser puts a live reverse proxy (the Nyasher framework) in front of the genuine Google sign-in. It relays the password, SMS codes, authenticator codes, Tap-Yes number matching and phone-based recovery, so MFA does not stop the takeover. The stolen session gives access to Gmail, Drive and OAuth grants in the victim's name. Material has taken down hundreds of lure domains through Cloudflare (Operation CloudFire), but new domains are registered days before each wave. Named victims and counts: unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-04T15:45:11+00:00","products":[{"name":"Google Workspace","fixed":[],"ecosystem":"vendor"},{"name":"Google Calendar","fixed":[],"ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning","phishing"],"not_affected_if":[],"how_to_check":"Calendar invites (often BCC, often from a known partner organization) with lures such as voicemail notifications, RFP/RFI requests, court summonses or missed payment notices, where the link goes through google.com/url?q=, share.google, a Google Drive file link or an Intuit transaction notification link and ends at a Cloudflare Turnstile check and then a Google sign-in page on a non-Google domain. In Google Workspace audit logs, look for sign-ins from unfamiliar IPs or devices right after such an invite, and for new OAuth grants or mail forwarding rules. The source publishes no specific domains.","fix":"Tell staff that a Google sign-in reached from a calendar invite link is suspect even when the link starts with google.com. Turn off automatic adding of invites from outside senders (Google Calendar setting 'only show invitations from known senders'). Move admins and high-risk users to passkeys or security keys, which a reverse proxy cannot relay. If someone signed in: revoke their sessions, remove OAuth grants and forwarding rules, and reset the account.","status":"open","published_at":null,"first_seen_at":"2026-11-04T15:45:11+00:00","triaged_at":"2026-11-04T15:45:11+00:00","updated_at":"2026-11-04T15:45:41+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-04':68B '-11':67B '-202611':30A '/url':96B '2026':48B,66B 'access':169B 'alreadi':87B 'arriv':71B 'august':47B 'authent':146B 'base':156B 'bcc':78B 'browser':122B 'built':119B 'calendar':2A,38A,74B 'campaign':39B 'check':116B 'cloudfir':192B 'cloudfire':33A 'cloudflar':114B,190B 'cmp':29A 'code':145B,147B 'corpor':59B 'count':205B 'day':198B 'domain':188B,195B 'drive':101B,172B 'earli':41B 'early-warn':40B 'file':102B 'framework':130B 'front':19A,132B 'genuin':135B 'get':11A 'give':168B 'gmail':171B 'go':91B 'googl':1A,7A,23A,56B,73B,93B,100B,136B 'google':35A,37A 'grant':175B 'hundr':185B 'intuit':108B 'invit':3A,75B 'link':90B,103B,111B 'live':6A,55B,125B 'lure':70B,187B 'match':152B 'materi':27A,61B,181B 'mfa':13A,159B 'mid':46B 'mid-august':45B 'name':180B,202B 'new':194B 'notif':110B 'number':151B 'nyasher':34A,129B 'o3b72k':31A 'oauth':174B 'often':80B 'one':106B 'oper':51B,191B 'operation':32A 'organ':83B 'page':118B 'password':143B 'past':12A 'phish':4A,43B,50B 'phone':155B 'phone-bas':154B 'proxi':17A,127B 'put':123B 'real':22A 'recipi':85B 'recoveri':157B 'redirector':97B 'regist':197B 'relay':141B 'report':65B 'research':64B 'revers':16A,126B 'secur':28A,62B 'session':9A,57B,167B 'share.google':98B 'sign':25A,138B 'sign-in':24A,137B 'sinc':44B 'sms':144B 'sometim':76B 'steal':5A,54B 'stolen':166B 'stop':162B 'taken':183B 'takeov':164B 'tap':149B 'tap-y':148B 'threat':63B 'transact':109B 'turnstil':115B 'unknown':206B 'user':60B 'variant':107B 'victim':178B,203B 'warn':42B 'wave':201B 'workspac':8A 'workspace':36A 'written':88B 'yes':150B","nicknames":["Operation CloudFire","Nyasher"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["calendar","googlecalendar","googleworkspace","nyasher","operationcloudfire","workspace"],"ptokens":["calendar","google","workspace"],"labels":["campaign","earlywarning","high","other","phishing"],"campaign_type":"phishing","first_public_at":"2026-11-04T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-o3b72k","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T15:45:11+00:00","fetched_at":"2026-11-04T15:45:11+00:00","note":null}],"documents":[{"id":67801,"url":"https://x.com/BleepinComputer/status/2117997798155260311","title":"@BleepinComputer: 📅 A Google Calendar invite. A legitimate Google link. A real MFA prompt. All par","kind":"post","source":"x","publisher":null,"text":"📅 A Google Calendar invite. A legitimate Google link. A real MFA prompt. All part of a phishing attack designed to hijack corporate sessions.\n\n🔍 @material_sec explains how it disrupted the campaign.\n\n➡️ https://t.co/cFClC1M4Im\n#cybersecurity #sponsored https://t.co/9mkdxl6jd4\n\nlikes 6 reposts 3","published_at":"2026-11-04T15:10:00+00:00","relation":"describes","confidence":null,"note":null},{"id":67856,"url":"https://www.bleepingcomputer.com/news/security/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa/","title":"Google Calendar phishing campaign hijacks sessions, bypasses MFA (Material Security, Operation CloudFire)","kind":"blog","source":"blog","publisher":null,"text":"Since mid-August 2026 a phishing operation harvests live Google sessions from corporate users. Lures arrive as Google Calendar invites, sometimes by BCC, often from an organization the recipient already corresponded with. Pretexts: voicemail notifications, RFP/RFI requests, court summonses, missed payment notices. Links use Google's /url redirector, share.google and Drive file links; one variant used Intuit transaction notification links. Cloudflare Turnstile gate, then a JavaScript-built reverse proxy in front of the real Google sign-in (Nyasher framework) relays SMS codes, authenticator codes, Tap-Yes number matching and phone recovery. Lure domains registered days before use. Material Security took down hundreds of domains via Cloudflare abuse (Operation CloudFire). Damage visible in Workspace audit logs; hijacked session reaches mail, Drive and OAuth grants.","published_at":"2026-11-04T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}