Google Calendar phishing campaign hijacks sessions, bypasses MFA
Summary
A phishing campaign abused Google Calendar invites, trusted redirects, and fake login pages to hijack corporate Google sessions and bypass MFA protections. Material Security documented the operation, dubbed Operation CloudFire, which included blocking malicious messages and helping take down nearly 900 attacker domains.
IFF Assessment
The article reports a takedown of nearly 900 attacker domains and blocked malicious messages, which is a defensive win, though the campaign itself was a serious threat.
Defender Context
Session hijacking and MFA bypass via legitimate-looking services like Google Calendar show that MFA alone is not sufficient against phishing. Defenders should monitor for anomalous session token use, review calendar invite and OAuth consent activity, and consider phishing-resistant authentication such as FIDO2 keys. Abuse of trusted SaaS platforms and redirects is a growing trend that evades URL reputation filtering.