Live Reverse Proxies Defeat MFA by Hijacking Google Sessions in Real Time
Written by AI from the linked story. Not reviewed by an editor. How this works
Operation CloudFire demonstrates that multi-factor authentication alone is no longer sufficient when attackers deploy adversary-in-the-middle (AiTM) reverse proxies that capture both credentials and session tokens simultaneously as users authenticate. The campaign exploited the inherent trust users place in familiar platforms — Google Calendar invites — to deliver convincing lures that bypassed suspicion. Because the proxy relays real Google pages dynamically, traditional defenses like visual inspection or even standard MFA tokens provide no protection once a user clicks through. This matters because stolen session cookies grant persistent, authenticated access that survives password resets, meaning the attacker can operate undetected long after the initial compromise. Organizations must move beyond password-and-OTP thinking toward phishing-resistant authentication and session anomaly detection.
Tactical Insight
Immediate actions
- Enroll all corporate Google accounts in FIDO2/hardware security key authentication, which is cryptographically bound to the legitimate origin and cannot be relayed by a reverse proxy.
- Configure Google Workspace context-aware access policies to block or challenge sessions originating from unexpected IP geolocations or unknown devices.
- Educate users to verify calendar invite senders via a secondary channel and treat unexpected Google sign-in prompts in invite links as highly suspicious.
Detection measures
- Deploy session anomaly monitoring to alert on simultaneous or rapid-succession logins from different IPs or user agents for the same account.
- Integrate Google Workspace audit logs into your SIEM and create rules that flag OAuth token issuance events immediately following a link click from a calendar invite.
- Enable impossible-travel alerts and token-replay detection within your identity provider or CASB solution.
Long-term improvements
- Migrate to phishing-resistant MFA (FIDO2/passkeys) across all SaaS platforms, eliminating the class of credential-relay attacks entirely.
- Implement a Zero Trust architecture requiring continuous device posture verification so that even a valid session token cannot be used from an unmanaged or anomalous endpoint.
- Conduct regular phishing simulation exercises that include AiTM scenarios so employees build intuition for proxy-based lures beyond classic credential-harvest pages.