A newly reported phishing campaign used Google Calendar invites, trusted redirect links and fake Google sign-in pages to steal corporate Google sessions, according to research cited by BleepingComputer. The campaign matters because it reportedly allowed attackers to bypass multi-factor authentication (MFA) not by breaking MFA itself, but by capturing an already authenticated user session.

What happened

According to BleepingComputer, the campaign was analysed by Material Security under the name Operation CloudFire. The attackers reportedly used Google Calendar invitations to make phishing messages appear more credible, then directed users through trusted-looking redirects to counterfeit Google login pages.

Material Security said the operation involved nearly 900 domains used by the attackers. The reported goal was to hijack active Google account sessions after a user completed the phishing flow. If successful, this can give attackers access to email and other connected business data without needing to repeatedly pass MFA checks.

The reported findings come from a security vendor's investigation and response work. The general technique, however, is well known in cybersecurity: rather than stealing only usernames and passwords, attackers try to capture session tokens or cookies that represent a logged-in user.

Why it matters for European businesses

For SMEs and larger organisations using Google Workspace, this incident highlights a practical security risk: MFA reduces account takeover risk, but it does not fully protect against session hijacking. If an attacker can steal a valid authenticated session, they may gain access to business email, calendars, files and other cloud-based workflows.

Email accounts remain a high-value target because they often sit at the centre of company operations. Access to one mailbox can help an attacker:

• read confidential conversations and attachments
• reset passwords for other SaaS tools
• impersonate staff in invoice fraud or supplier scams
• access calendar data and internal meetings
• move laterally into other cloud systems linked to the account

The use of Google Calendar is also significant from a user-awareness perspective. Employees may be more likely to trust a calendar invitation than a conventional phishing email, especially when it appears to come through a familiar platform and uses legitimate Google infrastructure during parts of the redirect chain.

For European businesses, the risk is not limited to IT disruption. A compromised business mailbox can lead to data exposure, fraud, operational downtime and potential GDPR-related incident assessment obligations, depending on what data is accessed and whether personal data is involved.

Who may be affected

The campaign is most relevant to organisations that rely on Google Workspace for day-to-day operations, including:

• SMEs with limited in-house security monitoring
• companies using Google accounts across email, drive, docs and calendars
• distributed teams that rely heavily on browser-based SaaS tools
• marketing, sales and finance teams frequently interacting with external contacts
• agencies and e-commerce businesses where one mailbox may connect to multiple third-party platforms

Businesses that assume MFA alone is sufficient protection may be particularly exposed if they have not deployed additional controls around session risk, phishing-resistant authentication, browser security and abnormal login detection.

What companies should consider

While the source report focuses on a specific campaign, the broader lesson is operational: organisations should review how they defend against session theft, not only password theft.

• Review Google Workspace security settings and verify alerting, suspicious login monitoring and session management controls are enabled.
• Train users to treat calendar invites as potential phishing vectors, especially when they contain unexpected login prompts, redirects or urgent requests.
• Harden identity controls beyond standard MFA. Where possible, consider phishing-resistant methods such as security keys or stronger device-based authentication.
• Reduce session risk by reviewing browser policies, endpoint protection and sign-in controls that can detect unusual device, location or token behaviour.
• Limit blast radius through least-privilege access, separate admin accounts and tighter controls on password resets and third-party app connections.
• Prepare an incident response process for account takeover scenarios, including forced sign-outs, token revocation, credential resets and review of mailbox rules or forwarding changes.
• Assess data exposure implications if a mailbox is compromised, including whether customer or employee personal data may have been accessed.

For business leaders, the main takeaway is that cloud identity attacks are becoming more sophisticated and increasingly use trusted platforms to lower suspicion. Companies using Google services should treat this as a reminder to strengthen account security, user awareness and response readiness rather than relying on MFA as a single line of defence.