{"id":246578,"date":"2026-11-05T02:44:05","date_gmt":"2026-11-05T08:44:05","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/11\/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa"},"modified":"2026-11-05T02:44:05","modified_gmt":"2026-11-05T08:44:05","slug":"google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/11\/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa","title":{"rendered":"Google Calendar phishing campaign hijacks sessions, bypasses MFA"},"content":{"rendered":"\n<p>Material Security\u2019s Threat Research team identified the campaign and has taken down hundreds of domains used by attackers in what they have dubbed Operation CloudFire. Here\u2019s what they learned along the way.<\/p>\n<p><b>The lure: Google Calendar invites<\/b><\/p>\n<p>The messages arrive as Google Calendar invites, sometimes delivered by BCC and often sent from an organization the recipient has already corresponded with. The pretexts are mundane: voicemail notifications, RFP and RFI requests, court summonses, and missed payment notices.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Material Security\u2019s Threat Research team identified the campaign and has taken down hundreds of domains used by attackers in what they have dubbed Operation CloudFire. Here\u2019s what they learned along the way. The lure: Google Calendar invites The messages arrive as Google Calendar invites, sometimes delivered by BCC and often sent from an organization the [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,1635],"tags":[],"class_list":["post-246578","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-materials"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/246578","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=246578"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/246578\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=246578"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=246578"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=246578"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}