Researchers at Material Security say a phishing operation they call CloudFire has been using fake Google Calendar invites to take over corporate Google Workspace sessions, including from users who complete multifactor authentication. The write-up ran on BleepingComputer as sponsored content from Material Security, so the findings and figures come from the vendor, as published on November 4.
The company says the campaign has been active since mid-August. Messages look like calendar invites, often from organizations the recipient already deals with and frequently sent from compromised accounts, with lures such as fake voicemail notices, RFP requests, court summonses and missed payment notices. Links pass through trusted redirectors, mainly Google’s own, so reputation checks see legitimate domains. The final page is a live reverse proxy in front of the real Google sign-in page, built in the browser only after a Cloudflare Turnstile check, which leaves scanners little to analyze.
The proxy relays SMS codes, authenticator codes, number-matching prompts and phone recovery to Google as the victim enters them, so Google accepts them as genuine and the attacker captures a valid session. That exposes Gmail and Drive and lets the attacker grant OAuth access in the victim’s name. Material says the attack framework, Nyasher, has been publicly documented since February.
Over one month the company recorded 68,676 blocked messages and 897 domains taken down, though those figures cover only customers who shared data. It says activity appears to be shifting toward Google Drive share lures and that the operator has an unactivated Microsoft 365 branch ready. Its advice is to treat calendar invites as a threat surface, combine several signals instead of relying on reputation alone, review Workspace audit logs, and be able to revoke sessions, contain OAuth grants and reset accounts within about an hour.