Google Calendar phishing hijacks sessions past MFA, Material Security says

What happened

Material Security says a phishing operation has been harvesting live Google sessions from corporate users since mid-August 2026, according to a sponsored article written by Material Security and published on BleepingComputer. The article is vendor-authored. The source contains no independent verification and no statement from Google.

According to Material Security:

• Delivery. The lures arrive as Google Calendar invites, sometimes sent by BCC and often from an organisation the recipient has already corresponded with. Pretexts include voicemail notifications, RFP and RFI requests, court summonses and missed payment notices (BleepingComputer).
• Links. Most links point to Google itself, typically Google’s /url redirector with the real destination in a query parameter. Other waves used share.google and Drive file links, and one variant used Intuit transaction notification links.
• Filtering step. Victims then pass a Cloudflare Turnstile challenge. In some builds this is the genuine widget.
• Capture. The final page is a live reverse proxy in front of the genuine Google sign-in page, and it is built in the browser by JavaScript, so it has no static page to scan.
• MFA relay. The proxy relays SMS codes, authenticator codes, Google’s Tap-Yes number matching and phone-based account recovery to Google, so these second-factor controls do not stop the session capture (BleepingComputer).

Material Security names the framework Nyasher. It says the framework has been documented publicly since February, after a hardcoded key was found in its JavaScript.

Material Security says it reported gateway and backend URLs to Cloudflare under an effort it calls Operation CloudFire. Cloudflare then applied its phishing interstitial to those destinations. Over one month, Material reports these figures, drawn only from customers who agreed to share data:

• 68,676 campaign messages blocked
• 2,112 unique malicious URLs analyzed
• 897 unique domains taken down
• 8,570 unique compromised sender addresses across 6,354 root domains

These figures are not independently confirmed (BleepingComputer).

On the current status, Material Security says:

• Themes have shifted from calendar invites to Google Drive file and document share invites.
• Activity “appears to have dispersed” and the campaign “looks finished”.
• The operator shipped an unfinished, inactive Microsoft 365 branch alongside the Google code. Material expects a future pivot with a different brand (BleepingComputer).

Not confirmed: the number of accounts actually compromised, the identity of the operator, and any confirmation from Google.

Am I affected?

According to Material Security, the campaign targeted corporate Google accounts. Your users may have been exposed if they received calendar invites, or later Drive share invites, that match all of the following (BleepingComputer):

• They came from known contacts or domains.
• They used mundane pretexts such as voicemail, RFP or RFI, court summons or missed payment.
• They contained Google /url redirector, share.google, Drive or Intuit links that led through a Cloudflare challenge to a Google sign-in page.

Material Security says that when the outcome is a hijacked session, the evidence appears in Workspace audit logs. It also says a live session gives access to mail, Drive and the ability to grant OAuth access in the victim’s name.

Per the source, a compromised sender address in your organisation may also have been used to send invites to its saved contacts.

What to do now

1. Search for matching lures. Look through mail and calendar data for invites matching the lures and link patterns described above, including Drive share invites, which Material Security says the operator moved to (BleepingComputer).
2. Review Workspace audit logs. Check sign-in and session activity for users who interacted with those invites, as Material Security says that is where session hijacks show up.
3. Contain suspected accounts. For any suspected account, revoke sessions, review and contain OAuth grants, and reset the account. Material Security says teams should be able to do this within an hour.
4. Check for compromised senders. Find out whether any of your own accounts sent calendar invites they should not have. Material Security says the campaign relied on compromised sender accounts.
5. Use the published indicators. For indicators and a timeline, the article points to a companion whitepaper from Material Security. A direct link is not included in the sources here.
6. Watch for a Microsoft 365 variant. Monitor for similar lures using Microsoft 365 branding, which Material Security says the operator has prepared but not activated.

Sources

• BleepingComputer: Google Calendar phishing campaign hijacks sessions, bypasses MFA (sponsored, written by Material Security)