Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign

Operation CloudFire demonstrates that multi-factor authentication alone is no longer sufficient when attackers deploy adversary-in-the-middle (AiTM) reverse proxies that capture both credentials and session tokens simultaneously as users authenticate. The campaign exploited the inherent trust users place in familiar platforms — Google Calendar invites — to deliver convincing lures that bypassed suspicion. Because the proxy relays real Google pages dynamically, traditional defenses like visual inspection or even standard MFA tokens provide no protection once a user clicks through. This matters because stolen session cookies grant persistent, authenticated access that survives password resets, meaning the attacker can operate undetected long after the initial compromise. Organizations must move beyond password-and-OTP thinking toward phishing-resistant authentication and session anomaly detection.