---
title: Hunt: calendar-invite phishing proxied the real Google sign-in to steal live sessions past MFA; Material took down 897 domains | ctxsec
url: https://ctxsec.com/items/hunt-material-operation-cloudfire-google-calendar-invite-aitm-nyasher
description: "Material Security's researchers tracked a campaign, running since mid-August 2026, that sent Google Calendar invites (often from compromised accounts at organizations the victim already knew) with voicemail, RFP, court-summons or missed-payment themes. Links went through Google's own /url redirector, share.google or Drive, then a Cloudflare Turnstile gate, to a live reverse proxy in front of the real Google sign-in page. That proxy relayed SMS codes, authenticator codes, number-match prompts and account recovery, so MFA didn't stop the theft. The capture page is assembled in the browser, so crawlers find nothing. The framework is the publicly documented 'Nyasher'. Over a month, Material reports 68,676 blocked messages, 897 domains taken down and 8,570 compromised sender addresses. It says the campaign appears to have dispersed, with an unfinished Microsoft 365 branch already in the code."
status: "confirmed research (Material Security threat research, Oct 1 and Oct 28; covered Nov 4)"
published: 2026-11-04
---

> Material Security's researchers tracked a campaign, running since mid-August 2026, that sent Google Calendar invites (often from compromised accounts at organizations the victim already knew) with voicemail, RFP, court-summons or missed-payment themes. Links went through Google's own /url redirector, share.google or Drive, then a Cloudflare Turnstile gate, to a live reverse proxy in front of the real Google sign-in page. That proxy relayed SMS codes, authenticator codes, number-match prompts and account recovery, so MFA didn't stop the theft. The capture page is assembled in the browser, so crawlers find nothing. The framework is the publicly documented 'Nyasher'. Over a month, Material reports 68,676 blocked messages, 897 domains taken down and 8,570 compromised sender addresses. It says the campaign appears to have dispersed, with an unfinished Microsoft 365 branch already in the code.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-material-operation-cloudfire-google-calendar-invite-aitm-nyasher.md)

confirmed research (Material Security threat research, Oct 1 and Oct 28; covered Nov 4)

2026-11-04

### Hunt: calendar-invite phishing proxied the real Google sign-in to steal live sessions past MFA; Material took down 897 domains

- **Workspace logs:** look for sign-ins followed quickly by a new device or IP using the same session, OAuth grants right after a calendar-invite click, and new mail forwarding or filters.
- **Mail and calendar:** flag external invites whose description links to `google.com/url?q=` or `share.google` and then go to newly registered domains. Consider requiring that external invites come only from known senders.
- **Fix:** phishing-resistant MFA (passkeys or security keys) breaks this relay. SMS, TOTP and number-match prompts don't.
- Material's whitepaper has the full indicator set.

Sources: [Material Security: Reputation Says It's Fine: calendar invites and a live MFA proxy steal Google sessions](https://material.security/resources/reputation-says-its-fine-how-calendar-invites-and-a-live-mfa-proxy-steal-google-sessions) · [Material Security: 897 domains later, how Operation CloudFire burned the calendar-invite campaign](https://material.security/resources/897-domains-later-how-operation-cloudfire-burned-the-calendar-invite-campaign) · [Material whitepaper (indicators, timeline)](https://content.material.security/hubfs/Material%20Security%20Site%20CMS/CalendarInviteWhitepaper-sep2026.pdf)