--- title: Google Calendar phishing campaign hijacks sessions,... description: A phishing operation has been hijacking live Google sessions from corporate users since mid-August 2026 using Google Calendar invites as lures. A reverse proxy... canonical: https://daily.dev/posts/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa-3x2qfuzhg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Google Calendar phishing campaign hijacks sessions, bypasses MFA | daily.dev og:description: A phishing operation has been hijacking live Google sessions from corporate users since mid-August 2026 using Google Calendar invites as lures. A reverse proxy... og:url: https://daily.dev/posts/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa-3x2qfuzhg og:image: https://api.daily.dev/og/posts/3X2QfUZhG.png og:image:alt: Google Calendar phishing campaign hijacks sessions, bypasses MFA og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Google Calendar phishing campaign hijacks sessions, bypasses MFA **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 7 min read · 0 upvotes · 0 comments ## Summary A phishing operation has been hijacking live Google sessions from corporate users since mid-August 2026 using Google Calendar invites as lures. A reverse proxy sits in front of the real Google sign-in page, relaying SMS codes, authenticator codes, and Tap-Yes prompts back to Google in real time, so MFA never stops the session capture. The campaign, dubbed Operation CloudFire by Material Security, used Google's own redirector, Cloudflare Turnstile, and browser-built credential pages to stay invisible to scanners. Over one month, customers who shared data with Material saw 68,676 messages blocked and 897 domains taken down, and the operator built an unfinished Microsoft 365 branch that has not been activated. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does a phishing attack bypass MFA like SMS codes or authenticator apps? A live reverse proxy sits in front of the real Google sign-in page and relays every second-factor response, SMS codes, authenticator codes, Tap-Yes number matching, and phone-based account recovery, straight to Google as the victim enters them. Since the victim is interacting with genuine Google prompts in real time, the attacker captures the resulting authenticated session rather than needing to defeat MFA directly. _Security teams tracking session-hijacking phishing techniques follow detailed breakdowns like this on daily.dev._ ### What is the Nyasher phishing framework? Nyasher is a phishing framework that runs a reverse proxy in front of genuine login pages to capture live authenticated sessions, including relaying MFA responses back to the real service. It has been documented publicly since February, after a hardcoded key was discovered in its JavaScript, and has been used in a large-scale Google Calendar invite phishing campaign. _Developers researching active phishing frameworks can keep up with disclosures like this on daily.dev._ ### Why do Google Calendar invite phishing links look safe but lead to credential theft? The links often point to Google's own /url redirector, share.google, or Drive file links, so the domain, certificate, and reputation all appear legitimate and trusted to scanners. Behind a Cloudflare Turnstile challenge, JavaScript builds the actual password-capture page only after the challenge clears, leaving no static page for crawlers or proxy logs to detect in advance. _Teams hardening email and calendar security watch for lure patterns like this on daily.dev._ ## Similar posts on daily.dev - [Cybercriminals Abuse Google Cloud Email Feature in Multi-Stage Phishing Campaign](https://daily.dev/posts/cybercriminals-abuse-google-cloud-email-feature-in-multi-stage-phishing-campaign-gra51ietd) · The Hacker News · 0 upvotes · 0 comments - [Attackers Use Multi-Hop Google Redirects for Phishing](https://daily.dev/posts/attackers-use-multi-hop-google-redirects-for-phishing-m2v0jkt52) · Dark Reading · 0 upvotes · 0 comments - [Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing](https://daily.dev/posts/tycoon2fa-hijacks-microsoft-365-accounts-via-device-code-phishing-zzaraji3g) · BleepingComputer · 1 upvotes · 1 comments - [BigBear 2.0 phishing campaign hijacks Microsoft 365 sessions after MFA](https://daily.dev/posts/bigbear-2-0-phishing-campaign-hijacks-microsoft-365-sessions-after-mfa-s6hwbxfj9) · CSO Online · 0 upvotes · 0 comments --- Tags: [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa-3x2qfuzhg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Google Calendar phishing campaign hijacks sessions, bypasses MFA","url":"https://daily.dev/posts/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa-3x2qfuzhg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa-3x2qfuzhg"},"datePublished":"2026-11-04T15:06:52.503Z","dateModified":"2026-11-04T15:07:22.935Z","description":"A phishing operation has been hijacking live Google sessions from corporate users since mid-August 2026 using Google Calendar invites as lures. A reverse proxy...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9b3c5b66b7bb8b8c00ecce44bc209394?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9b3c5b66b7bb8b8c00ecce44bc209394?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa-3x2qfuzhg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"phishing","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Google Calendar phishing campaign hijacks sessions, bypasses MFA"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa-3x2qfuzhg#faq","mainEntity":[{"@type":"Question","name":"How does a phishing attack bypass MFA like SMS codes or authenticator apps?","acceptedAnswer":{"@type":"Answer","text":"A live reverse proxy sits in front of the real Google sign-in page and relays every second-factor response, SMS codes, authenticator codes, Tap-Yes number matching, and phone-based account recovery, straight to Google as the victim enters them. Since the victim is interacting with genuine Google prompts in real time, the attacker captures the resulting authenticated session rather than needing to defeat MFA directly. Security teams tracking session-hijacking phishing techniques follow detailed breakdowns like this on daily.dev."}},{"@type":"Question","name":"What is the Nyasher phishing framework?","acceptedAnswer":{"@type":"Answer","text":"Nyasher is a phishing framework that runs a reverse proxy in front of genuine login pages to capture live authenticated sessions, including relaying MFA responses back to the real service. It has been documented publicly since February, after a hardcoded key was discovered in its JavaScript, and has been used in a large-scale Google Calendar invite phishing campaign. Developers researching active phishing frameworks can keep up with disclosures like this on daily.dev."}},{"@type":"Question","name":"Why do Google Calendar invite phishing links look safe but lead to credential theft?","acceptedAnswer":{"@type":"Answer","text":"The links often point to Google's own /url redirector, share.google, or Drive file links, so the domain, certificate, and reputation all appear legitimate and trusted to scanners. Behind a Cloudflare Turnstile challenge, JavaScript builds the actual password-capture page only after the challenge clears, leaving no static page for crawlers or proxy logs to detect in advance. Teams hardening email and calendar security watch for lure patterns like this on daily.dev."}}]} ```