Google Calendar invites are hijacking sessions and skipping past MFA

A phishing operation is using fake Google Calendar invites to steal active Google logins from corporate users, bypassing codes and approval prompts along the way. Material Security's Threat Research team found the campaign, which it calls Operation CloudFire, as reported by BleepingComputer. If a calendar invite arrives from an organization with a vague reason attached, such as a voicemail notice or a missed payment, treat the link inside it as unverified even though it points to a Google address.

What to do

• Pause before opening any calendar invite that references a voicemail, RFP, court summons or missed payment you were not expecting.
• Check the invite came from someone who actually meant to send it, by asking them directly rather than replying to the invite.
• Treat a second multi-factor prompt or code request as a signal something is wrong, not a formality to clear quickly.
• Report suspicious calendar invites to your organization's security team rather than deleting them quietly.

The campaign has been running since mid-August 2026. The invites arrive by BCC, often from an organization the recipient has already dealt with, which is why the sender looks familiar. Most of the links inside point to Google's own redirector, so the domain, certificate and reputation a mail filter checks all come back clean. Some waves used Google Drive links or Intuit transaction notices instead, for the same effect.

Behind the link sits a reverse proxy running in front of the real Google sign-in page. The person enters a password, gets a genuine prompt, and approves it, while the operator watches the session happen in real time. SMS codes, authenticator codes, Google's Tap-Yes number matching and phone-based recovery are all relayed straight through to Google as they arrive. None of them stop the session being captured, because the proxy is not guessing the credentials, it is standing between the person and the real login and copying what passes through.

The reputation checks that usually catch phishing answer a different question than the one this campaign is built to dodge. They ask who registered a domain, what else it has hosted, and whether anyone has complained about it. This campaign keeps those answers clean on purpose. The password-capture page itself has no static file for a crawler to fetch; the browser builds it only after a visitor clears a Cloudflare challenge, so there is nothing sitting on a server to scan in advance. Domains are registered days before use and dropped after, and one wildcard certificate was issued forty-six minutes before its domain even existed. Blocking one domain costs the operator a few dollars and an afternoon.

That design shows the scam was built to pass every automated check a security team would normally trust, which means the tell for this one is behavioral, not technical: an unexpected invite, a vague pretext, a second authentication request that should not be needed. Flggd tracks campaigns built around this kind of reputation-laundering, where the infrastructure is disposable and the checks that usually work are answered in advance.

Check a message

Received something like this? Paste it into the Flggd message checker before you reply, click or pay.

Related stories

• Why giving your date of birth to shops can help scammers impersonate you
• Scam Callers Are Asking Victims to Dial *21* on Their Own Phones
• Fake Insurance Agent Scams Grieving Man Out of $620 After Sister's Death