Operation CloudFire: How Attackers Used Google Calendar to Hijack Sessions and Defeat MFA at Scale
Executive Summary
Executive Summary Beginning mid-August 2026, a sophisticated phishing operation dubbed Operation CloudFire systematically harvested live Google Workspace sessions from corporate users by abusing Google Calendar invites as the initial lure. Attackers deployed the Nyasher reverse-proxy framework in front of genuine Google sign-in pages, relaying all MFA challenges—SMS codes, authenticator codes, and Tap-Yes prompts—in real time, effectively nullifying every second-factor control. Lure domains were registered days before use, infrastructure was disposable, and the final credential-capture page was JavaScript-constructed client-side, defeating crawlers and proxy logs. Over one month, 68,676 malicious messages were blocked, 897 domains taken down, and 8,570 unique compromised sender accounts identified across 6,354 root domains.
Operation CloudFire illustrates a maturing class of Adversary-in-the-Middle (AiTM) attacks that render traditional MFA and reputation-based email defenses insufficient. With an unactivated Microsoft 365 branch already embedded in the Nyasher codebase, threat actors are positioned to pivot campaigns rapidly, making session-hijacking infrastructure a persistent and escalating enterprise risk heading into 2027.
Why This Matters Now
Why This Matters NowAiTM phishing frameworks like Nyasher are publicly available and trivially extensible to new identity providers—the Microsoft 365 branch is already coded and dormant. As enterprises accelerate Google Workspace and Microsoft 365 adoption, session-token theft bypasses the MFA controls most security programs treat as a hard boundary, exposing mail, cloud storage, and OAuth grant chains to near-instant compromise with no stolen password required.
Attack Path Analysis
Attack Path AnalysisOperation CloudFire began with attacker-controlled compromised sender accounts delivering Google Calendar phishing invites that exploited trusted Google redirector URLs and Cloudflare Turnstile challenges to bypass reputation-based defenses, funneling victims into a Nyasher-based reverse proxy that relayed live MFA challenges and captured valid Google session tokens in real time. With harvested sessions granting full Workspace access, attackers escalated privileges via OAuth grant abuse, moved laterally across Google Drive and mail, established persistent command channels through the hijacked sessions, and exfiltrated sensitive data while inflicting reputational and operational damage across thousands of compromised corporate accounts.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionAttackers sent Google Calendar invites and Drive share notifications from previously compromised legitimate sender accounts, embedding Google-native redirector URLs (/url, share.google, Drive links) that pointed through Cloudflare Turnstile challenges to a Nyasher reverse proxy phishing page. Because the first hop resolved to trusted Google infrastructure and the final credential-capture page was constructed dynamically in the browser after challenge clearance, reputation systems, link scanners, and crawlers returned no malicious signals. Lure domains were registered days before use with wildcard certificates issued minutes before registration, making domain-age and certificate-history signals uninformative.
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesPhishing: Spearphishing Link
Multi-Factor Authentication Interception
Steal Web Session Cookie
Adversary-in-the-Middle
Compromise Infrastructure: Domains
Use Alternate Authentication Material: Web Session Cookie
Masquerading: Match Legitimate Name or Location
Account Manipulation: Device Registration
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Re-Authentication and Device Identification
Control ID: IA-11 / IA-3
PCI DSS 4.0 – Multi-Factor Authentication and Session Management
Control ID: Requirement 8.4 / 8.6
NYDFS 23 NYCRR 500 – Multi-Factor Authentication and Monitoring
Control ID: 500.12 / 500.14(b)
DORA (EU) 2022/2554 – ICT Security Controls and Anomaly Detection
Control ID: Article 9(4)(c) / Article 10
NIS2 Directive (EU) 2022/2555 – Incident Handling and Access Control
Control ID: Article 21(2)(b) / 21(2)(e)
CISA Zero Trust Maturity Model 2.0 – Continuous Identity Validation and Device Trust
Control ID: Identity Pillar — Advanced / Optimal / Device Pillar — Traditional
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Session hijacking via Google Calendar phishing bypasses MFA, exposing financial workflows, OAuth grants, and Drive-stored client data to credential harvesting with critical PCI 4.0 and NIST.800-53 compliance implications.
Information Technology/IT
Reverse-proxy Nyasher framework and disposable Cloudflare-hosted infrastructure evade east-west traffic controls and egress filtering, demanding Zero Trust segmentation and multicloud visibility to contain lateral movement post-compromise.
Legal Services
Court summons and RFP lures in Operation CloudFire directly target legal professionals, where hijacked Google Workspace sessions expose privileged client communications, case files, and OAuth-accessible Drive repositories.
Health Care / Life Sciences
Compromised Google sessions from calendar phishing threaten HIPAA 164.312(e)(1) compliance, enabling exfiltration of protected health information through live OAuth access before session revocation controls can respond.
Sources
Sources- Google Calendar phishing campaign hijacks sessions, bypasses MFAhttps://www.bleepingcomputer.com/news/security/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa/Verified
- Operation CloudFire: Material Security Threat Research Whitepaperhttps://material.security/research/operation-cloudfireVerified
- Phishing Attacks Using Legitimate Services - CISA Guidancehttps://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242aVerified
- Adversary-in-the-Middle (AiTM) Phishing and Business Email Compromise - Microsoft Security Bloghttps://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Nyasher AiTM Phishing Framework Public Documentation - GitHubhttps://github.com/search?q=nyasher+phishing
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because the attacker's entire post-compromise progression depended on unrestricted lateral reach across Google Workspace services and uncontrolled egress paths through cloud-native infrastructure. By enforcing segmented, identity-scoped access and constraining outbound traffic to approved destinations, CNSF would likely reduce the blast radius across compromised accounts and limit the attacker's ability to pivot freely across workloads and data stores.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF's unified visibility across cloud-native traffic flows would likely surface anomalous outbound connections to newly registered domains and reverse proxy endpoints that fall outside established egress baselines, potentially flagging the redirector chain before session capture completes.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of what a hijacked session token can reach within the cloud environment, reducing the attacker's ability to move freely across workloads and services using a single captured credential context.
Control: East-West Traffic Security
Mitigation: East-west enforcement across cloud workload paths would likely reduce the attacker's ability to pivot freely between Workspace services and connected OAuth applications using a single hijacked session, constraining the internal reach available to a compromised account identity.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility across outbound cloud traffic patterns would likely surface the recurring use of newly registered CDN-proxied endpoints as relay destinations, potentially allowing policy responses that constrain the active relay channels the attacker depends on for real-time session management.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement on outbound cloud traffic would likely constrain the attacker's ability to establish OAuth-driven data pipeline channels to unapproved external destinations, reducing the volume and persistence of exfiltration paths that survive credential resets.
With segmented workload access, constrained east-west paths, and egress controls applied at earlier stages, the residual impact across compromised accounts would likely be narrowed in scope — reducing the number of reachable services per hijacked session and limiting how broadly OAuth-granted persistence channels could propagate across the organization.
Impact at a Glance
Affected Business Functions
- Corporate Email and Calendar Collaboration (Google Workspace)
- Cloud Document and File Storage (Google Drive)
- Identity and Access Management (OAuth / SSO Session Integrity)
- Security Operations and Incident Response (Audit Log Monitoring)
Estimated downtime: 3 days
Estimated loss: N/A
Hijacked live Google Workspace sessions exposed corporate email inboxes, Google Drive documents, and the ability to authorize OAuth applications on behalf of victims. Over 8,570 unique sender accounts were compromised across 6,354 root domains, meaning attacker-controlled sessions had access to sensitive business communications, shared files, financial records, and the contacts of every compromised user. Because session tokens rather than passwords were stolen, standard password-reset controls did not immediately revoke attacker access. The blast radius for each compromised session included full mail read/write access, document exfiltration from Drive, and the potential to grant persistent OAuth access enabling long-term persistence beyond the initial session window. Downstream contacts of compromised senders were also targeted, amplifying the exposure of organizational PII and business-confidential communications.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Egress Security & Policy Enforcement (CNSF) to block outbound connections to newly registered domains and enforce FQDN-based filtering that flags domains registered within 30 days, preventing victim browsers from successfully resolving Nyasher reverse proxy endpoints even after clicking a trusted Google redirector URL.
- • Deploy Multicloud Visibility & Control to continuously monitor Google Workspace audit logs for anomalous session origin patterns, unusual OAuth grant issuance, and cross-service access sequences that indicate session token hijacking rather than legitimate user activity, enabling sub-hour detection and revocation response.
- • Enforce Zero Trust Segmentation with identity-based policy to restrict OAuth application authorization rights by user role and require out-of-band approval workflows for any new OAuth grant, ensuring that a captured session token cannot autonomously establish persistent third-party data access pipelines without additional verification.
- • Leverage Cloud Firewall (ACF) with AI-assisted traffic discovery to identify and block browser-based connections to dynamically constructed phishing pages hosted behind CDN providers, specifically targeting certificate issuance anomalies where wildcard certificates are issued within minutes of domain registration as a policy enforcement trigger.
- • Utilize Threat Detection & Anomaly Response capabilities to baseline normal Google Workspace session geography, device fingerprints, and access velocity per user, then generate automated alerts and session revocation workflows when hijacked sessions exhibit attacker-controlled access patterns inconsistent with the victim's established behavioral baseline.
