[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPRFUSzNS-axelu9iOqWrHbxzO-xsJ-VuYT_-1V5nWfs":3},{"article":4,"iocs":54,"watch_terms":58,"solutions":59,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f30ca5b4-51f7-439a-a3c2-dfe497b34c7d","Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign","calendar-invites-and-live-proxies-inside-a-google-session-hijacking-campaign-cd8772","Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a link came back clean, and the operator designed it that way on purpose. The Threat Research team at Material Security spotted the campaign and has since taken down hundreds of attacker domains in an effort the team calls Operation CloudFire.","A phishing operation has been stealing live Google sessions from corporate users since mid-August 2026, using Google Calendar invites as lures. The campaign, dubbed Operation CloudFire by Material Security, employs a live reverse proxy in front of the Google sign-in page to capture credentials and second-factor authentication codes. The attackers use a framework known as Nyasher, designed to evade typical security checks by dynamically building pages in the browser.","Google session hijacking campaign uses calendar invites and live proxies to steal corporate credentials.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fcalendar-invites-and-live-proxies.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhf8YVgw9hIWEYN0_qgaD6MVIZad0fOCu_J5Z4Cn2CDuMzcV7HOQ9Xt4E08l1nOo7uMjAyYqYP-bUy5zHisRW8cfeSVmJcCKYgCTI2y1MpRUwsM1I2cs0MsuoAy7VSGLyTPzonhKITzWPU1hTADZnFt5VTZhlt4eJohVas2tzhl47AOV3Cp53LC_uhlpVY\u002Fs1600\u002Fmt.jpg","2026-11-12T11:51:31+00:00","2026-11-12T13:00:29.011407+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Operation CloudFire","campaign",{"name":21,"type":22},"Material Security","vendor",{"name":24,"type":25},"Google Calendar","technology",{"name":27,"type":25},"Cloudflare Turnstile",{"name":29,"type":30},"Google","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55],{"type":46,"value":56,"context":57},"Nyasher","Framework used for session hijacking",[21,29],{"controls":60,"vendors":145},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":91,"name":92,"problem":93,"products":94},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":120,"name":121,"problem":122,"products":123},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[124,132,137],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":133,"product_name":134,"url":135,"description":136},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[146],{"slug":147,"name":29,"logo_path":148,"roles":149},"google","\u002Fvendor-logos\u002Fgoogle.png",[150],"affected",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":161},"live-reverse-proxies-defeat-mfa-by-hijacking-google-sessions-in-real-time","Live Reverse Proxies Defeat MFA by Hijacking Google Sessions in Real Time","Operation CloudFire demonstrates that multi-factor authentication alone is no longer sufficient when attackers deploy adversary-in-the-middle (AiTM) reverse proxies that capture both credentials and session tokens simultaneously as users authenticate. The campaign exploited the inherent trust users place in familiar platforms — Google Calendar invites — to deliver convincing lures that bypassed suspicion. Because the proxy relays real Google pages dynamically, traditional defenses like visual inspection or even standard MFA tokens provide no protection once a user clicks through. This matters because stolen session cookies grant persistent, authenticated access that survives password resets, meaning the attacker can operate undetected long after the initial compromise. Organizations must move beyond password-and-OTP thinking toward phishing-resistant authentication and session anomaly detection.",[156,157,158,159,160],"MITRE ATT&CK T1557: Adversary-in-the-Middle","MITRE ATT&CK T1539: Steal Web Session Cookie","NIS2 Article 21(2)(j)","NIST SP 800-53 IA-8: Identification and Authentication (Non-Organizational Users)","CIS Control 14: Security Awareness and Skills Training (v8)",{"NIS2 Article 21(2)(j)":162,"MITRE ATT&CK T1557: Adversary-in-the-Middle":163,"MITRE ATT&CK T1539: Steal Web Session Cookie":164,"CIS Control 14: Security Awareness and Skills Training (v8)":165,"NIST SP 800-53 IA-8: Identification and Authentication (Non-Organizational Users)":166},"NIS2 explicitly requires multi-factor authentication and secured communications; this incident shows that OTP-based MFA is bypassable and that phishing-resistant MFA (e.g., FIDO2) is what Article 21(2)(j) demands in practice.","The Nyasher framework operates as a live reverse proxy between the victim and Google, intercepting credentials and session tokens in transit — the exact technique T1557 describes.","The campaign's core objective is capturing live authenticated session cookies via the proxy so attackers can replay them without needing the user's password or MFA code again.","Users were the entry point via calendar invite lures; CIS Control 14 requires training employees to recognize and report social-engineering attacks, including unexpected authentication prompts embedded in collaboration-platform invites.","IA-8 requires strong authentication mechanisms for external-facing services; deploying hardware-bound FIDO2 credentials would have prevented the proxy from relaying a usable authentication factor."]