A sophisticated phishing campaign, dubbed “Operation CloudFire” by Material Security’s Threat Research team, has been actively hijacking live Google sessions from corporate users since at least mid-August 2023. This campaign leverages Google Calendar invitations and a multi-layered infrastructure to bypass traditional security defenses, including multi-factor authentication (MFA), making it a significant threat to organizational security postures. The success of this operation lies in its ability to present what appears to be legitimate Google infrastructure, thereby circumventing conventional link analysis and reputation checks.
Technical Analysis: Sophisticated Session Hijacking & MFA Bypass
The Google Calendar phishing session hijacking campaign initiates with seemingly innocuous Google Calendar invites. These invitations often originate from organizations the recipient has previously corresponded with, using mundane pretexts such as voicemail notifications, RFP/RFI requests, court summonses, or missed payment notices. Crucially, the initial links in these invites often point to legitimate Google services, such as Google’s own /url redirector, share.google.com, or Drive file links, further enhancing their perceived legitimacy. This tactic directly undermines security solutions that rely on domain reputation or static link analysis, as the initial hop is to a trusted Google domain, according to BleepingComputer.
Behind these seemingly legitimate fronts, the attackers operate a live reverse proxy using the NyAsher framework. This framework, publicly documented since February, plays a central role in the NyAsher framework MFA bypass technique. When a victim clicks the link and proceeds, they encounter a Cloudflare Turnstile challenge (sometimes the genuine widget), followed by the phishing page itself. This page is not static; it is dynamically constructed in the browser after the challenge is cleared, making it difficult for crawlers or proxies to record or scan.
The real danger emerges when the victim enters their credentials on the proxied Google sign-in page. The attacker’s server relays the password to Google in real-time, and crucially, also relays all subsequent MFA prompts, including SMS codes, authenticator app codes, Google’s Tap-Yes number matching, and phone-based account recovery requests. This means that even with MFA enabled, the attacker observes and uses the victim’s second factor in real-time to complete the authentication process. Once authenticated, the attacker gains a live, authenticated Google session, effectively bypassing all traditional credential and MFA protections.
Impact and Detection Challenges
A hijacked live Google session grants attackers extensive access beyond just the inbox. It provides access to Google Mail, Google Drive, and the ability to grant OAuth permissions in the victim’s name. This broad access significantly expands the potential blast radius of a successful compromise, allowing for data exfiltration, further phishing campaigns, or even business email compromise (BEC) attacks. The infrastructure supporting Operation CloudFire is designed to be disposable, with lure domains and receiving endpoints registered just days before use, making traditional blocking mechanisms less effective.
One key challenge for defenders is that single-signal detection mechanisms are insufficient. The campaign’s design intentionally evades analysis based solely on reputation or link structure. Furthermore, calendar invites are often not subjected to the same rigorous inspection as email messages, leaving a blind spot in many organizations’ security defenses.
Actionable Recommendations: Defending Against Google Calendar Phishing Session Hijacking
To effectively detect Operation CloudFire TTPs and mitigate the risk of similar sophisticated campaigns, organizations must implement a multi-faceted defense strategy:
- User Education and Awareness: Train users to be highly suspicious of unsolicited calendar invites, even if they appear to come from trusted sources or contain links to legitimate Google domains. Emphasize that MFA does not protect against live session hijacking via sophisticated proxies.
- Enhanced Detection Capabilities: Implement security solutions that analyze multiple indicators, including the apparent intent of messages, actual link resolution, and sender relationships, rather than relying on single signals like domain reputation. Solutions that treat calendar invites as a primary threat surface are crucial.
- Proactive Log Monitoring: Continuously monitor Google Workspace audit logs for anomalous session activity, unusual OAuth grants, or suspicious access patterns. Focus on identifying access from new or uncommon IP addresses immediately after user login.
- Rapid Incident Response: Establish and regularly practice rapid incident response procedures. The ability to quickly revoke active sessions, contain unauthorized OAuth grants, and reset affected accounts within a very short timeframe (e.g., within an hour) is paramount to minimizing damage from hijacked sessions.
- Infrastructure Takedown Collaboration: While difficult for individual organizations, engaging with cybersecurity vendors and abuse reporting platforms (like Cloudflare’s) can aid in disrupting attacker infrastructure, as demonstrated by Material Security’s Operation CloudFire.
Related: Q2 2026 IR Trends: Phishing, MFA Bypass, RMM Tool Abuse, Human-Operated Phishing Steals AI Ad Account Credentials