Operation CloudFire: How a Phishing Campaign Exploited Google Calendar

Overview of Operation CloudFire

Since mid-August 2026, a sophisticated phishing operation has been targeting corporate users through Google Calendar invites, exploiting them to hijack live Google sessions. Identified by Material Security’s Threat Research team, this operation, dubbed Operation CloudFire, systematically bypassed traditional security measures, including multi-factor authentication (MFA).

The operation was characterized by its ingenious use of authentic channels, where attackers sent invitations mimicking legitimate organizational correspondences. The lures included everyday notifications such as voicemail alerts, payment reminders, and even legal summons.

The Phishing Tactics

The fundamental tactic of this campaign involved sending what appeared to be authentic Google Calendar invitations. Many were sent using BCC, enhancing the illusion of trust as they often originated from organizations the recipients had previously interacted with. Most of the links embedded in these invites pointed back to Google services, utilizing Google’s own /url redirector that masked the real destination in a query parameter, further complicating detection by security protocols.

Some messages employed links to Google Drive files and Intuit transaction notifications, all appearing legitimate upon initial scrutiny.

Session Hijacking Mechanism

Behind the scenes, the attackers utilized a live reverse proxy that presented the genuine Google sign-in page to victims. Unsuspecting users would input their passwords and approve authentication requests directly in front of the attackers, who then monitored the session in real time. Each SMS code, authenticator code, and account recovery input was seamlessly relayed to Google, effectively allowing the malicious actor to hijack the session without triggering typical security alerts.

The operation leveraged a framework known as Nyasher. This self-constructed mechanism had been publicly documented since early February after its critical components were discovered. This sophisticated approach prevented standard scanners from detecting the phishing attempts due to how the pages were dynamically constructed in the victim's browser.

Why Traditional Protections Failed

The failure of traditional security controls can be traced back to the campaign’s deliberate design. Reputation systems, which typically validate domains based on prior usage, were misled due to the use of a Google redirector in the initial link. Further obscuring detection, the security checks did not consider the final destination until the user was already engaged with the fake page.

The intricate multi-layered approach of the phishing campaign introduced various hurdles for detection systems, encompassing:

• Legitimate domain usage: The attack leveraged domains that presented positive reputational signals.
• Dynamic web elements: The phishing infrastructure included elements that were generated post-engagement, making earlier scans ineffective.
• Disposable infrastructure: Many of the phishing domains were registered mere days before their use, which allowed quick abandonment to evade detection.

Material Security's Defense Strategy

To combat the evolving threat, Material Security actively monitored the phishing campaign, amassing data on each variant as they proliferated. This included tracking how lures and methods adapted to avoid being flagged by static detections. Throughout the campaign, Material’s defenses successfully intercepted over 99% of the malicious messages, maintaining a reclassification rate of just 0.01%.

Recognizing that no single signal or method could adequately address the threat, Material adopted a holistic approach that considered multiple factors:

• Message intent and context: Evaluating the nature of the message alongside technical signals.
• Link destination analysis: Confirming where links ultimately resolved.
• Email sender verification: Scrutinizing the context of sending relationships to detect anomalies.

Impact on Victims

Hijacking a session instead of merely stealing credentials has far-reaching implications for victims. Session hijacking allows attackers to move laterally across the victim's digital life, gaining access to email, shared drives, and the capability to grant OAuth permissions on behalf of the victim, thereby widening the scope of potential exploitation.

This underscores the need for organizations to regularly audit their Google Workspace activity. It’s critical for security teams to swiftly analyze logs to identify suspicious behaviors and effectively counteract any unauthorized actions.

Security teams must ask:

• Who is managing log reviews? Timeliness is crucial in assessing potential compromises.
• Can sessions be revoked quickly? The ability to contain damage rapidly is vital when dealing with live sessions.

Operation CloudFire: Direct Action Against Threat Infrastructure

In response to the increasing sophistication of the phishing attempts, Material Security initiated Operation CloudFire in late September 2026. This operation aimed to actively dismantle the infrastructure supporting the phishing campaign rather than simply enhancing detection protocols.

The initiative involved:

• Analyzing gateway URLs: Tracking the domains used to send the malicious emails.
• Reporting through Cloudflare: Engaging with Cloudflare’s abuse reporting mechanisms to validate and mitigate the threat.
• Applying interstitial warnings: Once identified, victims who clicked the reported links were redirected to a phishing alert instead of the credential capture page.

As a result, during this month-long initiative, Material Security's metrics included:

Current Status of the Campaign

As it stands, the phishing campaign that relied on Google Calendar invites appears to have subsided, with Material noting a shift towards Google Drive document and file sharing invitations as the next phase of attempts. Despite this apparent retreat, the risk remains that the operators have not abandoned the field. The framework utilized throughout these phases has been accessible since early this year, and a parallel branch targeting Microsoft 365 has been noted.

Key features of this ongoing threat indicate the potential for future iterations, as the operator has a groundwork for launching new attempts with minimal modifications.

Key Takeaways

• Operation CloudFire has successfully blocked over 68,000 phishing messages since its inception.
• Material Security identified 2,112 unique URLs in active use during the campaign.
• The phishing operation exploited trusted domains and overlooked security measures.
• Session hijacking grants attackers access to email and storage systems, increasing damage potential.
• Security teams are urged to review audit logs regularly and act swiftly to revoke sessions.

Conclusion

Operation CloudFire illustrates the evolving landscape of phishing attacks, particularly those targeting high-profile platforms like Google Workspace. As sophisticated tactics are employed, organizations must remain vigilant and proactive in their defenses, understanding that the potential for similar operations persists. Continuous monitoring, education on threat awareness, and rapid response capabilities are essential to mitigating risks posed by evolving phishing campaigns.