What Happened: Google Calendar Phishing Campaign
A Google Calendar phishing campaign is hijacking corporate Google sessions and bypassing MFA protections, according to BleepingComputer. The campaign uses Google Calendar invites, trusted redirects, and fake login pages to steal access to business Google accounts. It is a reminder that calendar invites now carry the same risk as email attachments.
BleepingComputer credits an examination by Material Security. The report describes an effort called Operation CloudFire, in which Material Security tracked the attacks, blocked malicious messages, and helped take down nearly 900 domains used by the attackers. Nearly 900 domains is a large amount of infrastructure to prepare, and it suggests the attackers planned for takedowns.
Timeline
No timeline for the campaign has been published yet. The BleepingComputer report appeared on November 4, 2026, and that is the only date in the source.
Who Is Affected
The source describes the target as corporate Google sessions, not consumer accounts. That puts organizations using Google Calendar for work accounts in scope, including your clients and your own business if you run on Google Workspace.
The practical impact falls on whoever clicks. Calendar invites are a normal part of business, so the chance that someone in your client's company clicks a malicious link is high. Assume a click will happen and make sure the response steps are already clear.
For MSPs, this matters twice. Your clients are exposed, and so is your own team. If an attacker compromises your internal Google session, they can use it to reach client systems and data.
Technical Details
The source lists no CVE for this campaign and no Google Calendar version. The attack does not depend on a product flaw. According to BleepingComputer, the attack vector is a Google Calendar invite, a trusted redirect, and a fake login page, used together to hijack corporate Google sessions and bypass MFA protections.
The word 'trusted redirect' matters. Attackers use redirects that appear to come from a service the user already trusts, which makes the fake login page feel legitimate. This is a standard phishing technique, not a defect in the calendar product.
What to Do This Week
You cannot patch this, so the work is procedural. The steps below are standard hardening for a calendar-based phishing threat, and they apply to any client on Google Workspace.
- Tell your team and your clients to treat calendar invites like email attachments. Check the sender and the domain before clicking anything, especially when the invite comes from outside your organization.
- Review Google Workspace session management settings and be ready to sign users out of active sessions if an account is exposed. In general, periodic session reviews are a good habit.
- Remind everyone that MFA alone does not stop session hijacking. If an attacker has the session token, they do not need your password again, so MFA protections do not catch them.
- Audit authorized OAuth apps and third-party access for the Google accounts you manage. Revoke anything you do not recognize. As a standing practice, do this review on a schedule.
- Set a simple rule for clients: if a calendar invite asks you to sign in to view it, close it and go directly to the service instead. Legitimate calendar invites should not require a login to accept.
- Have a response plan ready for a compromised session, including revoking access, resetting passwords, and checking sign-in activity. Run through the plan with your team once so it is not the first time when an incident happens.
What to Tell Clients
A phishing campaign is using Google Calendar invites to send people to fake login pages. If you enter your Google password on one of those pages, the attacker can take over your session, and your normal MFA prompt will not stop them.
If an invite asks you to sign in to see it, do not click the link. Open a new browser tab, go to your Google account directly, and sign in from there. Check the sender, and report anything unexpected to your IT team.
If you think you already clicked a bad link, tell your IT team as soon as possible. They can sign you out of active sessions, review your account activity, and remove anything the attacker added. The faster you report it, the less time the attacker has.
Bottom Line
This campaign is a reminder that the calendar has become a phishing channel. The fix is not a patch, it is a behavior change and a monitoring plan.
Pick one step from the list above and put it in motion this week. The goal is to make sure the next invite with a fake login page gets reported instead of clicked.
Frequently Asked Questions
How Does This Google Calendar Phishing Campaign Bypass MFA?
The campaign uses fake login pages to steal a user's session after they authenticate. Once the attacker has the session token, MFA does not stop them because the session is already considered valid. The source describes the chain as a Google Calendar invite, a trusted redirect, and a fake login page. It does not provide a step-by-step breakdown beyond that.
Is Google Calendar Itself Vulnerable?
The source does not list a CVE or a vulnerable version of Google Calendar. The campaign appears to abuse normal behavior, such as trusting calendar invites and following redirects, rather than exploiting a flaw in the product. That means the fix is user awareness and monitoring, not a software update.
What Is Operation CloudFire?
Operation CloudFire is the name used in the BleepingComputer report for this campaign. According to the report, Material Security tracked the attacks, blocked malicious messages, and helped take down nearly 900 domains used by the attackers. It is the name attached to the investigation in the report.
How Can I Tell If a Google Calendar Invite Is a Phishing Attempt?
Check the sender and the domain before clicking anything. Be suspicious of any invite that takes you to a login page, and be especially careful with invites from people outside your organization. When in doubt, type the address of the service directly into your browser instead of clicking the link. These checks will not catch everything, but they catch the pattern this campaign uses.
What Should I Do If a Client Clicked a Fake Login Link?
Treat it as a compromised session. Sign the user out of active sessions, reset their password, review recent account activity, and check for unauthorized OAuth apps. If you have a security response process, run it now. The goal is to cut off access before the attacker uses the stolen session.
Does This Affect Personal Gmail Accounts?
The source describes the target as corporate Google sessions, so business accounts are the stated target. The same caution applies to any Google account, but the reporting focuses on corporate use. MSPs should prioritize business accounts and then apply the same advice to personal accounts if you want to be thorough.
Sources
- Google Calendar phishing campaign hijacks sessions, bypasses MFABleepingcomputer · Reported
What This Touches
Check these in your stack and your clients'.
Google develops consumer and business technology products, including Search, the Gemini AI models, Google Workspace and Google Cloud.