22 mins ago
Google Calendar phishing campaign hijacks sessions, bypasses MFA
What's happening
SignalsMonitor is following this as a conflict story. BleepingComputer is the outlet attached so far. The first report grouped here was at 4 Nov 2026, 15:00 UTC. The headline in use is “Google Calendar phishing campaign hijacks sessions, bypasses MFA”. This note is SignalsMonitor's own briefing, not the publisher's article.
What we know
A phishing campaign used Google Calendar invites, trusted redirects, and fake login pages to hijack corporate Google sessions and bypass MFA protections. Material Security examines how Operation CloudFire tracked the attacks, blocked malicious messages, and helped take down nearly 900 domains used by the attackers.
Story timeline
Reports grouped into this story, earliest first. Exact repeats from the same outlet are collapsed.
- First reported by BleepingComputer
Google Calendar phishing campaign hijacks sessions, bypasses MFA
Reported by 1 outlet
- BleepingComputer
- BleepingComputerGoogle Calendar phishing campaign hijacks sessions, bypasses MFA