Per Bleeping Computer, a sophisticated phishing operation active since mid-August 2026 has been harvesting live Google sessions from corporate users by leveraging legitimate infrastructure to bypass traditional security filters.
The campaign, dubbed Operation CloudFire by the Material Security Threat Research team, utilized Google Calendar invites as a primary lure. Attackers sent messages appearing to be from known contacts, using mundane pretexts such as payment notices or document requests. The attack employed a reverse proxy positioned in front of genuine Google sign-in pages, allowing operators to capture credentials and bypass multi-factor authentication in real time. Because the phishing links utilized legitimate Google redirectors and dynamic JavaScript-constructed pages, they successfully evaded reputation-based security tools. The infrastructure was highly disposable, with attackers frequently rotating domains and certificates. In response, Material Security launched a takedown effort, reporting malicious endpoints to Cloudflare and successfully blocking over 68,000 messages. While the campaign appears to have subsided, researchers warn that the attackers possess the capability to pivot toward Microsoft 365 targets. The incident highlights the limitations of relying solely on domain reputation, as attackers now exploit trusted services to facilitate session hijacking. Security teams are advised to monitor Workspace audit logs and ensure they can rapidly revoke compromised sessions.
Source: Bleeping Computer
