Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign

Since mid-August 2026, a phishing campaign has been hijacking Google sessions by leveraging malicious Google Calendar invites sent from compromised accounts. The lures appear legitimate, often using BCC and familiar sender domains, and redirect through Google's own URL shortener or trusted services like share.google.com. Upon clicking, victims are proxied through a live reverse proxy framework called Nyasher, which captures credentials and multi-factor authentication tokens in real time by relaying them to the legitimate Google sign-in page. The infrastructure uses ephemeral domains, wildcard certificates, and client-side JavaScript rendering to evade detection, with operators rotating tactics to bypass static and machine learning-based defenses. The campaign, dubbed Operation CloudFire by Material Security, was mitigated through infrastructure takedowns via Cloudflare abuse reporting, protecting broader user bases beyond individual organizations.

AI-extracted · verify before operational use