Google Calendar phishing campaign hijacks sessions, bypasses MFA

As cited

Copy frozen at 2026-11-04 17:44 UTC (site build).

threat intel

Google Calendar phishing campaign hijacks sessions, bypasses MFA

A phishing campaign leveraged Google Calendar invites and trusted redirects to compromise corporate Google accounts and circumvent multifactor authentication (MFA) protections. Material Security documented the attacks, attributed to Operation CloudFire, and assisted in taking down approximately 900 malicious domains used by the threat actors.

Why it matters: Corporate employees using Google Workspace face credential theft through calendar-based phishing even with MFA enabled; security teams should review email filtering, redirect policies, and user training to block this attack vector.

Source published

2026-11-04 15:00 UTC

First seen by Cybersecurity Tracker

2026-11-04 17:14 UTC