Google Calendar phishing campaign hijacks sessions and bypasses MFA
PHISHINGredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A phishing campaign abused Google Calendar invitations, trusted redirects and fake login pages to hijack corporate Google sessions and bypass MFA protections. Material Security documents how Operation CloudFire tracked the activity, blocked malicious messages and helped remove nearly 900 attacker domains. The article gives no CVE IDs or affected versions. Defenders should review session token and sign-in activity for Google Workspace accounts and treat unexpected calendar invitations with suspicion.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Treat unexpected Google Calendar invitations and login prompts with suspicion, as they were the lure in this campaign.
- Review the Material Security write-up for details on how the campaign was tracked and blocked.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
BleepingComputer