Google Calendar phishing hijacks sessions, bypasses MFA

A phishing campaign leveraged Google Calendar invites and trusted redirects to lure users to fake login pages, compromising corporate Google sessions and bypassing multi-factor authentication. Operation CloudFire tracked the attacks across nearly 900 malicious domains. Security researchers blocked the malicious messages and helped take down the infrastructure. Organizations should educate users on calendar invite risks and enforce additional verification for sensitive account access.