Ethical Hacking News
A highly sophisticated phishing campaign targeting Google sessions has been making waves in the cybersecurity landscape. Dubbed "Operation CloudFire," the campaign has been stealing live Google sessions from corporate users, often masquerading as legitimate Google Calendar invites. The campaign's operators have been using a range of tactics to evade detection, including using legitimate-looking domains, certificates, and reputation systems to create a convincing facade. To catch the attackers off guard, the Material Security team targeted the campaign's infrastructure, disrupting the campaign's operations and preventing further attacks. This article provides an in-depth look at the campaign and its tactics, highlighting the importance of cybersecurity teams staying vigilant and adapting to new threats.
Operation CloudFire is a sophisticated phishing campaign targeting Google sessions. The campaign has been stealing live Google sessions from corporate users, often masquerading as legitimate Google Calendar invites. The campaign's operators use a range of tactics to evade detection, including using legitimate-looking domains and certificates. The campaign has been ongoing since mid-August 2026 and has been continuously adapting its tactics. The campaign's use of a reverse proxy allows it to capture user passwords and sensitive information. The campaign's success highlights the importance of treating calendar invites as a threat surface. The campaign's evasive tactics raise questions about the effectiveness of security teams in responding to phishing attacks. The Material Security team's proactive approach to security disrupted the campaign's operations and prevented further attacks.
In recent months, a highly sophisticated phishing campaign has been making waves in the cybersecurity landscape, specifically targeting Google sessions. The campaign, dubbed "Operation CloudFire" by the researchers at Material Security, has been stealing live Google sessions from corporate users, often masquerading as legitimate Google Calendar invites. The campaign's operators have been using a range of tactics to evade detection, including using legitimate-looking domains, certificates, and reputation systems to create a convincing facade.
According to the researchers, the campaign began in mid-August 2026 and has been ongoing since then, with the operators continuously adapting and evolving their tactics to stay one step ahead of security teams. The campaign's use of a reverse proxy in front of the real Google sign-in page allows the operators to capture the user's password and other sensitive information, which can then be used for malicious purposes.
One of the key factors that has contributed to the campaign's success is its ability to evade detection by traditional security controls. The campaign's operators have been using a range of tactics to avoid detection, including using legitimate-looking domains, certificates, and reputation systems to create a convincing facade. The researchers noted that the campaign's use of a reverse proxy in front of the real Google sign-in page allowed the operators to capture the user's password and other sensitive information, which can then be used for malicious purposes.
In order to catch the attackers off guard, the Material Security team decided to take a different approach. Instead of focusing solely on detecting the phishing campaign, they decided to target the campaign's infrastructure. By reporting the campaign's gateway and backend URLs to Cloudflare's abuse reporting system, the researchers were able to disrupt the campaign's operations and prevent further attacks.
The campaign's use of a reverse proxy in front of the real Google sign-in page also highlights the importance of security teams treating calendar invites as a threat surface of their own. The researchers noted that calendar invites need to be treated as a threat surface, with the account's full history used as context next to the technical signals.
The campaign's success also raises questions about the effectiveness of security teams in responding to phishing attacks. The researchers noted that a hijacked session leaves its trail in Google Workspace audit logs, which can be used to identify the affected user and take action to revoke sessions and contain OAuth grants. However, the researchers also noted that this process can be slow and may not always be effective.
In conclusion, Operation CloudFire highlights the importance of cybersecurity teams staying vigilant and adapting to new threats. The campaign's use of a sophisticated phishing campaign and its ability to evade detection by traditional security controls make it a serious threat to corporate users. By taking a proactive approach to security and targeting the campaign's infrastructure, the Material Security team was able to disrupt the campaign's operations and prevent further attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Operation-CloudFire-Unmasking-the-Sophisticated-Phishing-Campaign-Targeting-Google-Sessions-ehn.shtml
https://thehackernews.com/2026/11/calendar-invites-and-live-proxies.html
Published: Thu Nov 12 09:00:13 2026 by llama3.2 3B Q4_K_M
