Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign

Since mid-August 2026, a phishing campaign has been stealing live Google sessions from corporate users, bypassing standard link checks. Material Security's Threat Research team spotted the operation and has taken down hundreds of attacker domains in an effort called Operation CloudFire. The campaign uses calendar invites and live proxies to evade detection.