Google Calendar phishing campaign hijacks sessions and bypasses MFA
PHISHINGredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Attackers sent fake Google Calendar invites that led people to counterfeit login pages. The scheme could take over corporate Google sessions even where extra login protection was in use. Researchers at Material Security helped track the campaign and get nearly 900 of the attackers' domains taken down.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Treat unexpected Google Calendar invitations and login prompts with suspicion, as they were the lure in this campaign.
- Review the Material Security write-up for details on how the campaign was tracked and blocked.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
BleepingComputer