Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign

Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users using calendar invites and live proxies. Material Security says every check defenders normally use to judge a link came back clean by the operator’s design, and its team has taken down hundreds of attacker domains in an effort it calls Operation CloudFire.