Operation CloudFire Phishing Campaign Hijacks Google Sessions

# Operation CloudFire Phishing Campaign Hijacks Google Sessions

https://gcdradar.vercel.app/incidents/operation-cloudfire-phishing-campaign-hijacks-google-session · AIR-2026-1768 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed active phishing campaign with session hijacking.
- Fix status: No fix needed
- First reported: 2026-11-04
- AI role: No AI role
- Products: Google Calendar

## Summary

A phishing campaign used Google Calendar invites and fake login pages to bypass multi-factor authentication and hijack corporate sessions. Security researchers tracked the attacks and assisted in taking down hundreds of domains used in the campaign.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-04: Google Calendar phishing campaign hijacks sessions, bypasses MFA (https://bleepingcomputer.com/news/security/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa)

## Sources

- 2026-11-04 BleepingComputer: Google Calendar phishing campaign hijacks sessions, bypasses MFA https://bleepingcomputer.com/news/security/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa
- 2026-11-12 The Hacker News: Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign https://thehackernews.com/2026/11/calendar-invites-and-live-proxies.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.