The Google Calendar Phishing Attack That Bypasses MFA—and What It Means for You

Michael Miller · 2026-11-04

### When a Calendar Invite Becomes a Weapon You know that little pop-up when a Google Calendar invite lands in your inbox? Most of us click "Yes" without a second thought. That's exactly what attackers are counting on. A new phishing campaign, dubbed Operation CloudFire, is using calendar invites to sneak past security and hijack corporate Google sessions—even when multi-factor authentication (MFA) is turned on. Here's the kicker: these aren't your typical sketchy emails. The invites come from trusted sources, redirect through legitimate Google domains, and land on fake login pages that look identical to the real thing. Once you enter your credentials, the attackers grab your session token and waltz right in. MFA? Bypassed. Alarms? Silent. ### How Operation CloudFire Pulls It Off The folks at Material Security tracked this campaign and helped take down nearly 900 malicious domains. Here's the playbook: - **Calendar invites as bait:** Attackers send invites that appear to be from colleagues or partners. The subject line often references a meeting, a document, or an urgent request. - **Trusted redirects:** Clicking the invite link takes you through a series of Google-owned URLs, which makes the link look legitimate to both you and your security tools. - **Fake login pages:** You're prompted to sign in again—but the page is a pixel-perfect copy of Google's login screen. - **Session hijacking:** Once you enter your credentials, the attackers steal your session cookie. They don't need your password anymore; they're already inside. ### Why MFA Doesn't Save You Here MFA is great at stopping password-only attacks. But this campaign sidesteps it entirely by hijacking an active session. Think of it like this: MFA is a deadbolt on your front door, but the attackers climbed in through a window you left open—your calendar. And because the malicious pages are hosted on trusted domains, traditional phishing filters often miss them. That's why this campaign is so effective. ### What You Can Do to Stay Safe You don't need to swear off Google Calendar. But you do need to be a little more skeptical. Here are a few practical steps: - **Hover before you click:** Check the actual URL of any link in a calendar invite. If it doesn't match the expected domain, don't click. - **Verify unexpected invites:** If you get an invite from someone you don't know or didn't expect, confirm with them through another channel (like a quick chat or phone call). - **Enable advanced protection:** Google's Advanced Protection Program adds extra layers, like blocking suspicious downloads and using security keys. - **Use antidetect browsers for sensitive work:** If you manage multiple accounts or need to isolate sessions, antidetect browsers can help you keep your digital identity separate and secure. - **Stay updated:** Keep your browser and security software patched. Attackers exploit known vulnerabilities. ### The Bigger Picture Operation CloudFire is a reminder that phishing isn't just about fake emails anymore. Attackers are getting creative—and they're targeting the tools we trust most. As Material Security's takedown of 900 domains shows, the good guys are fighting back. But ultimately, your best defense is a healthy dose of skepticism and a few smart habits. So next time a calendar invite pops up, take a breath. Hover over that link. Ask yourself: did I really expect this? A little caution goes a long way.