Google Calendar phishing campaign hijacks sessions, bypasses MFA

A phishing campaign exploited Google Calendar invites and trusted redirects to hijack corporate Google sessions and bypass MFA. Material Security's Operation CloudFire tracked the attacks, blocked malicious messages, and helped take down nearly 900 attacker domains. The campaign targeted corporate users, using fake login pages to steal credentials and session tokens, highlighting the need for advanced email security measures.