Operation CloudFire Phishing Abuses Google Calendar Invites to Hijack Sessions

En bref

• Operation CloudFire targets Google accounts through calendar invitation lures
• Attackers use trusted redirects and counterfeit sign-in screens to capture active sessions
• Nearly 900 domains were involved; Google and Material Security intercepted messages and coordinated takedowns
• Organizations using Google Workspace face business account compromise risk

Security teams have linked a broad credential-theft operation, tracked as Operation CloudFire, to a campaign that turns Google Calendar invitations into a pathway for account takeover. The lure arrives as a meeting request; recipients who follow it pass through a trusted redirect before landing on a counterfeit sign-in screen. The objective is not merely passwords but active Google sessions, allowing attackers to slip past multi-factor authentication and reach business accounts.

Because calendar invitations often appear to come from known contacts or internal systems, they can bypass user skepticism and some email filters. Organizations that depend on Google Workspace for mail, calendaring, and collaboration are the primary exposure group, and the technique is equally relevant to school districts and government agencies where shared calendars are routine.

The scale is notable: almost 900 domains were involved in the infrastructure. Material Security and Google responded by intercepting harmful messages and coordinating efforts to take domains offline, according to the available reporting. No software vulnerability or CVE is associated with the activity; it relies on social engineering and abuse of trusted services.

The risk is that session theft defeats a control many organizations treat as a backstop. A single successful click can give an intruder persistent access without triggering a password prompt. Defenders should watch for unexpected calendar invites, unusual redirect chains, and session or token anomalies that suggest an account has been replayed.

Users remain a critical sensor: encourage reporting of unsolicited meeting requests and verify links through separate channels. Administrative teams should review calendar sharing settings, external invite policies, and session controls, and be prepared to revoke sessions quickly if suspicious activity appears.

À faire maintenant

1. Enforce phishing-resistant MFA such as FIDO2 security keys or passkeys for privileged and high-risk accounts; review legacy MFA methods that can be relayed or phished.
2. Restrict Google Calendar external sharing and automatic invite additions; require verification for unknown senders and disable auto-accept where possible.
3. Monitor Workspace login and session logs for anomalous token use, impossible travel, and unusual OAuth grants; revoke suspicious sessions immediately.
4. Block known malicious domains and redirect patterns at email and web gateways; update filtering with indicators from Google and Material Security reporting.
5. Shorten session lifetimes and apply conditional access based on device posture, location, and risk; require re-authentication for sensitive actions.
6. Run targeted user awareness on calendar-based lures and counterfeit sign-in pages; provide a one-click report button for suspicious invitations.
7. Audit third-party app access and OAuth permissions in Google Workspace; remove unused grants and limit administrative roles.

Source originale

BleepingComputer