Operation CloudFire hijacks Google sessions and bypasses multifactor authentication

BleepingComputer reported Nov. 4, 2026 that Material Security’s Threat Research team said Operation CloudFire began in mid-August 2026, hijacking corporate Google sessions through Google Calendar invites.< Attackers send the calendar invites through BCC and from hijacked accounts to lure recipients to malicious links. Material Security said the lures include voicemail notifications, court summonses, missed payment notices, and RFP or RFI requests. The campaign’s send cadence followed U.S. business hours, suggesting targeted timing.< The attackers register domains days before use and rely on disposable infrastructure, including wildcard certificates issued 46 minutes before domain registration, a design Material Security said makes takedowns costly for defenders. They route victims through Google’s /url redirector and share.google/Drive file links, which appear legitimate in reputation checks, and some waves also used Intuit transaction notification links as lures.< A reverse proxy sits before a genuine Google sign-in page. It captures credentials in real time while relaying SMS codes, authenticator codes, and Tap-Yes prompts to Google. Material Security said this bypasses all second-factor controls. The campaign seized live Google sessions, letting attackers read mail, open Drive files, and use OAuth grants.< The attack framework Nyasher became public in February 2026 after a hardcoded key surfaced in its JavaScript. Nyasher builds credential-capture pages in the browser on the fly, which helps it evade static scans. Operation CloudFire avoids detection with a chain that includes a Cloudflare Turnstile challenge, Google’s redirector, and a credential-capture page generated on the fly. Material Security said defenders cannot scan a static site because none exists, and proxy logs contain no record of the page.< “The framework behind this, Nyasher, has been documented publicly since February, after a hardcoded key was found in its JavaScript.” — Material Security< Material Security started Operation CloudFire in late September 2026 to go after attacker infrastructure. Researchers reported malicious URLs through Cloudflare’s abuse system, and Cloudflare blocked the domains with phishing interstitials. Over one month, Operation CloudFire removed 897 unique domains, stopped 68,676 malicious messages, and reviewed 2,112 unique URLs. Material Security said the data reflects only customers sharing logs with it.< Compromised sender addresses totaled 8,570 across 6,354 root domains, and attackers used the addresses to send calendar invites to saved contacts. Material Security said this lends credibility to the lures, and that attackers reused compromised accounts before sending invites.< Attackers have moved from Google Calendar invites to Google Drive file and document share invitations, though no new tactics appeared. Material Security expects future pivots to other brands, including Microsoft 365. Nyasher also has a Microsoft 365 branch with unresolved paths for a stylesheet, a harness, and a title string tied to a Microsoft sign-in prompt, suggesting unfinished development. No active Microsoft-branded attacks have been observed yet.< Material Security said it stopped 99 percent of malicious messages starting in August 2026. Its reclassification rate was 0.01 percent. The scoring weighed technical indicators, what the message intended, and who sent it. Attackers keep changing the campaign to slip past static, machine-learning, and agentic detections.< Defenders should watch Workspace audit logs for hijacked sessions. Security teams should kill hijacked sessions and lock down OAuth grants within an hour. Evidence of hijacked sessions appears in Workspace audit logs. Material Security said most organizations cannot move fast enough.