Operation CloudFire: Sophisticated Phishing Campaign Hijacks Google Sessions via Calendar Invites
A stealthy phishing campaign dubbed Operation CloudFire has been targeting corporate Google users since mid-August 2026, successfully stealing live session cookies by employing legitimate-looking calendar invites and reverse proxies.
A sophisticated phishing operation, codenamed Operation CloudFire, has been actively stealing live Google session cookies from corporate users since mid-August 2026. The campaign's effectiveness stems from its meticulous design, which bypasses traditional security measures by leveraging seemingly innocuous Google Calendar invites and legitimate-looking domains.
The attackers' primary lure involves sending Google Calendar invitations that appear as routine notifications, such as voicemail alerts, RFP requests, or payment reminders. These invites are often sent via BCC or from contacts the recipient has previously interacted with, further enhancing their credibility. Crucially, many of the initial links in these invites direct victims through Google's own URL redirectors or utilize trusted domains like share.google and Drive file links, masking the malicious intent.
Once a victim clicks on a deceptive link, they are directed to a page that hosts a live reverse proxy positioned in front of the genuine Google sign-in portal. This allows attackers to capture credentials in real-time. The proxy is designed to seamlessly pass along second-factor authentication (2FA) prompts, including SMS codes, authenticator app codes, or Google's Tap-Yes prompts, ensuring that even multi-factor authentication does not prevent session hijacking.
The underlying framework powering this operation, identified as Nyasher, has been publicly documented previously. Its ability to dynamically build the capture page in the victim's browser, rather than relying on a static site, poses a significant challenge for automated detection systems. This dynamic approach means that web crawlers have nothing to fetch, and proxy logs offer no record of the malicious page, making traditional scanning and analysis methods ineffective.
Operation CloudFire's infrastructure is designed for ephemerality. Attackers register numerous lure domains just days before use, often across various registrars, and deploy receiving endpoints for short periods. This disposable infrastructure makes it difficult and costly for defenders to block malicious assets permanently. Early waves saw domains registered mere days before their associated endpoints went live, with some wildcard certificates issued just minutes before the domain was even created.
Material Security's Threat Research team, which identified and dismantled hundreds of malicious domains associated with this campaign, found that a multi-layered detection strategy was necessary. Relying on reputation alone was insufficient, as all initial indicators appeared legitimate. Effective detection required weighing technical indicators against the apparent intent of the message, the final destination of the links, and the sending relationship, recognizing that calendar invites themselves represent a distinct threat surface.
The impact of a hijacked Google session extends far beyond email access. Attackers gain the ability to access mail, Google Drive, and crucially, can grant OAuth access in the victim's name. This significantly broadens the potential for data exfiltration and further compromise within an organization's Google Workspace environment. The speed at which attackers can operate with a live session raises critical questions about incident response times and the ability to revoke compromised sessions before extensive damage occurs.
By late September, the Material Security team shifted focus from solely detection to actively dismantling the campaign's infrastructure. By reporting malicious gateway and endpoint URLs through Cloudflare's abuse system, they were able to get these phishing destinations flagged, forcing the attackers to constantly re-register and re-deploy their infrastructure, thereby disrupting their operations and protecting a wider range of potential victims.