# Phishing Campaign Exploits Calendar Invites to Hijack Google Sessions

*Published November 13, 2026*
*Source: [https://thehackernews.com/2026/11/calendar-invites-and-live-proxies.html](https://thehackernews.com/2026/11/calendar-invites-and-live-proxies.html)*

## Executive Summary

A phishing campaign has been hijacking Google sessions by using calendar invites and proxy connections to bypass security checks. This sophisticated operation, discovered by Material Security, resulted in the takedown of numerous malicious domains, highlighting the need for improved detection and response strategies.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/phishing-campaign-exploits-calendar-invites-to-hijack-google-sessions) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Since mid-August 2026, a sophisticated phishing campaign has targeted corporate users by hijacking live Google sessions. This operation has managed to bypass conventional security checks, primarily through clever manipulation of calendar invites and proxy connections. Discovered by the Threat Research team at Material Security, the campaign exploited Google Calendar invites that appeared mundane, such as voicemail notifications and missed payment alerts, to lure victims into clicking links. These links, cleverly disguised as legitimate Google URLs, redirected users to a malicious proxy mimicking the real Google sign-in page. Once the user entered their credentials, the attacker captured them in real-time, effectively bypassing multi-factor authentication.

The infrastructure supporting this campaign, known as Nyasher, was designed to evade detection by using legitimate-looking domains and certificates. It employed a multi-layered setup, including Google's redirector and Cloudflare's Turnstile challenge, to avoid raising suspicion. The pages used for phishing were dynamically generated, making them hard to detect with traditional scanning methods. The campaign's infrastructure was transient, with domains and certificates being frequently rotated and discarded, complicating efforts to block it.

Material Security's proactive approach, labeled Operation CloudFire, involved the takedown of hundreds of malicious domains. Their strategy included a comprehensive analysis of message intent, link destinations, and sender relationships, rather than relying solely on reputation or link analysis. The team's efforts were successful in intercepting over 99% of malicious messages, although the attacker continually altered tactics.

Security teams face challenges in detecting such advanced threats, as traditional methods are often ineffective. Reviewing Google Workspace audit logs can help identify unauthorized session activity. The campaign prompted security professionals to consider the speed and efficiency of their response to breaches. By late September, researchers focused on dismantling the phishing infrastructure itself, reporting malicious URLs to Cloudflare, which then placed warnings on flagged pages. Although the current campaign phase seems to have ended, the potential for reemergence remains, especially with similar tactics potentially being applied to other platforms like Microsoft 365.