---
id: "CMP-202611-o3b72k"
kind: "campaign"
aliases: []
title: "Google Calendar invite phishing steals live Google Workspace sessions and gets past MFA through a reverse proxy in front of the real Google sign-in (Material Security)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Google Workspace", "fixed": [], "ecosystem": "vendor"}, {"name": "Google Calendar", "fixed": [], "ecosystem": "vendor"}]
ecosystems: []
tags: ["campaign", "early-warning", "phishing"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-04T15:45:11+00:00"
updated_at: "2026-11-04T15:45:41+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-04T15:45:11+00:00"}]
---

# Google Calendar invite phishing steals live Google Workspace sessions and gets past MFA through a reverse proxy in front of the real Google sign-in (Material Security)

Since mid-August 2026 a phishing operation has been stealing live Google sessions from corporate users (Material Security Threat Research, reported 2026-11-04). The lures arrive as Google Calendar invites, sometimes by BCC and often from an organization the recipient has already written to. Links go through Google's own /url redirector, share.google or Google Drive file links, and in one variant Intuit transaction notification links. After a Cloudflare Turnstile check, a page built in the browser puts a live reverse proxy (the Nyasher framework) in front of the genuine Google sign-in. It relays the password, SMS codes, authenticator codes, Tap-Yes number matching and phone-based recovery, so MFA does not stop the takeover. The stolen session gives access to Gmail, Drive and OAuth grants in the victim's name. Material has taken down hundreds of lure domains through Cloudflare (Operation CloudFire), but new domains are registered days before each wave. Named victims and counts: unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Google Workspace affected ? fixed ?
- vendor:Google Calendar affected ? fixed ?

## How to check

Calendar invites (often BCC, often from a known partner organization) with lures such as voicemail notifications, RFP/RFI requests, court summonses or missed payment notices, where the link goes through google.com/url?q=, share.google, a Google Drive file link or an Intuit transaction notification link and ends at a Cloudflare Turnstile check and then a Google sign-in page on a non-Google domain. In Google Workspace audit logs, look for sign-ins from unfamiliar IPs or devices right after such an invite, and for new OAuth grants or mail forwarding rules. The source publishes no specific domains.

## Fix

Tell staff that a Google sign-in reached from a calendar invite link is suspect even when the link starts with google.com. Turn off automatic adding of invites from outside senders (Google Calendar setting 'only show invitations from known senders'). Move admins and high-risk users to passkeys or security keys, which a reverse proxy cannot relay. If someone signed in: revoke their sessions, remove OAuth grants and forwarding rules, and reset the account.

## Timeline

- 2026-11-04T15:45:11+00:00 analyst

## Documents

- [describes] @BleepinComputer: 📅 A Google Calendar invite. A legitimate Google link. A real MFA prompt. All par https://x.com/BleepinComputer/status/2117997798155260311
- [describes] Google Calendar phishing campaign hijacks sessions, bypasses MFA (Material Security, Operation CloudFire) https://www.bleepingcomputer.com/news/security/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_