Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign

A phishing campaign since August 2026 steals Google sessions from corporate users via calendar invites, bypassing standard link-security checks. Material Security's threat team discovered the operation, termed CloudFire, and took down hundreds of attacker domains. This targets enterprise email security defenses.

https://thehackernews.com/2026/11/calendar-invites-and-live-proxies.html