Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign

A phishing operation has been ongoing since mid-August 2026, targeting corporate users and stealing their live Google sessions. The campaign was designed to evade detection, with all checks on links coming back clean. The Threat Research team at Material Security discovered the campaign and has taken down hundreds of attacker domains as part of an effort called Operation CloudFire. This operation has been successful in disrupting the phishing campaign. The attackers had intentionally designed the operation to avoid raising suspicions. The campaign's tactics allowed it to go undetected for a period of time.