[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f46ToKjaFHsZSg09uOFBIAx6gHuaVEiWmzNIpYM1Qgpk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"58dc4368-92a8-4edf-ad3f-c1a07ebf2e43","live-reverse-proxies-defeat-mfa-by-hijacking-google-sessions-in-real-time","f30ca5b4-51f7-439a-a3c2-dfe497b34c7d","Live Reverse Proxies Defeat MFA by Hijacking Google Sessions in Real Time","Operation CloudFire demonstrates that multi-factor authentication alone is no longer sufficient when attackers deploy adversary-in-the-middle (AiTM) reverse proxies that capture both credentials and session tokens simultaneously as users authenticate. The campaign exploited the inherent trust users place in familiar platforms — Google Calendar invites — to deliver convincing lures that bypassed suspicion. Because the proxy relays real Google pages dynamically, traditional defenses like visual inspection or even standard MFA tokens provide no protection once a user clicks through. This matters because stolen session cookies grant persistent, authenticated access that survives password resets, meaning the attacker can operate undetected long after the initial compromise. Organizations must move beyond password-and-OTP thinking toward phishing-resistant authentication and session anomaly detection.","**Immediate actions:**\n- Enroll all corporate Google accounts in FIDO2\u002Fhardware security key authentication, which is cryptographically bound to the legitimate origin and cannot be relayed by a reverse proxy.\n- Configure Google Workspace context-aware access policies to block or challenge sessions originating from unexpected IP geolocations or unknown devices.\n- Educate users to verify calendar invite senders via a secondary channel and treat unexpected Google sign-in prompts in invite links as highly suspicious.\n\n**Detection measures:**\n- Deploy session anomaly monitoring to alert on simultaneous or rapid-succession logins from different IPs or user agents for the same account.\n- Integrate Google Workspace audit logs into your SIEM and create rules that flag OAuth token issuance events immediately following a link click from a calendar invite.\n- Enable impossible-travel alerts and token-replay detection within your identity provider or CASB solution.\n\n**Long-term improvements:**\n- Migrate to phishing-resistant MFA (FIDO2\u002Fpasskeys) across all SaaS platforms, eliminating the class of credential-relay attacks entirely.\n- Implement a Zero Trust architecture requiring continuous device posture verification so that even a valid session token cannot be used from an unmanaged or anomalous endpoint.\n- Conduct regular phishing simulation exercises that include AiTM scenarios so employees build intuition for proxy-based lures beyond classic credential-harvest pages.",[12,13,14,15,16],"MITRE ATT&CK T1557: Adversary-in-the-Middle","MITRE ATT&CK T1539: Steal Web Session Cookie","NIS2 Article 21(2)(j)","NIST SP 800-53 IA-8: Identification and Authentication (Non-Organizational Users)","CIS Control 14: Security Awareness and Skills Training (v8)",{"NIS2 Article 21(2)(j)":18,"MITRE ATT&CK T1557: Adversary-in-the-Middle":19,"MITRE ATT&CK T1539: Steal Web Session Cookie":20,"CIS Control 14: Security Awareness and Skills Training (v8)":21,"NIST SP 800-53 IA-8: Identification and Authentication (Non-Organizational Users)":22},"NIS2 explicitly requires multi-factor authentication and secured communications; this incident shows that OTP-based MFA is bypassable and that phishing-resistant MFA (e.g., FIDO2) is what Article 21(2)(j) demands in practice.","The Nyasher framework operates as a live reverse proxy between the victim and Google, intercepting credentials and session tokens in transit — the exact technique T1557 describes.","The campaign's core objective is capturing live authenticated session cookies via the proxy so attackers can replay them without needing the user's password or MFA code again.","Users were the entry point via calendar invite lures; CIS Control 14 requires training employees to recognize and report social-engineering attacks, including unexpected authentication prompts embedded in collaboration-platform invites.","IA-8 requires strong authentication mechanisms for external-facing services; deploying hardware-bound FIDO2 credentials would have prevented the proxy from relaying a usable authentication factor.","published","2026-11-12T13:21:39.570384+00:00","2026-11-12T13:21:39.55+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fcalendar-invites-and-live-proxies.html","calendar-invites-and-live-proxies-inside-a-google-session-hijacking-campaign-cd8772","Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[45,49,53],{"slug":46,"name":47,"problem":48},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":50,"name":51,"problem":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":54,"name":55,"problem":56},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]