Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a link came back clean, and the operator designed it that way on purpose.
The Threat Research team at Material Security spotted the campaign and has since taken down hundreds of attacker domains in an effort the team calls Operation CloudFire. Here’s what the researchers found.
The messages show up as Google Calendar invites. Some arrive by BCC, and many come from an organization the recipient has already traded email with. The pretexts are deliberately boring: voicemail notifications, RFP and RFI requests, court summonses, and missed payment notices. Nothing about them stands out in a busy inbox.
Most of the links point to Google itself. The usual pattern runs through Google’s own /url redirector, with the real destination tucked into a query parameter. Other waves used share.google and Drive file links the same way, and one variant leaned on Intuit transaction notification links. Whenever a message gets scored, the domain, certificate, and reputation on display are all legitimate.
Once a victim clicks through, the attacker runs a live reverse proxy in front of the real Google sign-in page. The victim types a password, gets a genuine prompt, and approves it while the operator watches in real time. The server passes each second factor along to Google as it comes in, whether that’s an SMS code, an authenticator code, Google’s Tap-Yes number matching, or phone-based account recovery. None of those controls stop the session from being captured.
Source link
