Findings from Material Security’s disruption effort, dubbed Operation CloudFire, show how an adversary-in-the-middle (AiTM) phishing campaign hijacked corporate Google sessions after users completed MFA.
Attackers used trusted Google redirects and reverse proxies to capture authenticated sessions, potentially exposing Gmail, Drive, and OAuth access.
Organizations should prioritize phishing-resistant authentication, investigate suspicious sessions, revoke compromised access, and verify containment.
Hexnode IdP supports device-compliance requirements through Conditional Access, restricting covered sign-ins that fail device-trust checks. Revoking compromised Google sessions requires separate remediation.
The Operation CloudFire phishing MFA bypass findings describe an adversary-in-the-middle (AiTM) campaign targeting corporate Google sessions. Material Security tracked the phishing activity from mid-August 2026 and launched Operation CloudFire to disrupt the attackers’ infrastructure. The campaign captured authenticated sessions while victims completed legitimate MFA challenges.
For enterprise security teams, the incident highlights a specific gap: completing MFA does not establish that subsequent session activity belongs to the legitimate user. Protecting access requires stronger authentication, appropriate access policies, and tested account containment procedures.
Operation CloudFire phishing MFA bypass explained
The attack began with Google Calendar invitations, often from organizations recipients recognized. Links used trusted Google redirects before leading victims through a challenge page to an attacker-controlled sign-in flow.
A live reverse proxy relayed interactions with Google’s genuine authentication service. Victims entered passwords and completed real MFA challenges while attackers captured the resulting authenticated sessions. Material reported support for SMS codes, authenticator codes, and Google’s number-matching prompts.
The capture interface assembled in the browser after the challenge, complicating static inspection. Attackers also rotated disposable infrastructure across registrars. A trusted initial URL therefore provided little assurance about the final destination.
Lures later shifted toward Google file and document sharing. In its October 28 update, Material reported 897 domains taken down and 68,676 messages blocked over one month. These figures covered participating customers. Researchers said activity appeared to have dispersed and the campaign seemingly ended, while warning that attackers could rebuild.
Featured Resource
Cybersecurity kit
Access essential cybersecurity resources to strengthen security, reduce risk, and improve cyber resilience.
A hijacked Google session can expose Gmail and Drive and enable OAuth authorization in the user’s name, subject to applicable controls. Responders should therefore investigate connected applications and file activity alongside mailbox access.
For example, a compromised employee account could expose project documents and support convincing follow-up messages to colleagues. Treat this as a potential account takeover requiring investigation, even when the user remembers approving a legitimate-looking authentication prompt. Assess the permissions and data available to that specific account.
MFA remains valuable, but authentication methods differ. Google recommends security keys over verification codes for stronger phishing protection. Prioritize phishing-resistant authentication for administrators and other high-risk users, while reviewing recovery options that could weaken the intended protection.
Responding to Operation CloudFire phishing MFA bypass risks
To reduce automatic calendar additions from unfamiliar senders, open Google Calendar > Settings > Event settings > Add invitations to my calendar and select Only if the sender is known. This setting does not block invitations from compromised known senders or prevent invitation emails from arriving.
Use Google’s compromised-account guidance to build a response procedure:
Temporarily suspend suspected compromised accounts and investigate unauthorized activity.
Review sign-in, OAuth, Drive, and Calendar logs, together with suspicious forwarding settings.
For federated accounts, terminate the SSO session before resetting Google sign-in cookies.
Assign each action to an administrator with the required privileges. Preserve relevant logs and record affected accounts, applications, and observed changes for follow-up investigation.
Google notes that cookie resets can take up to an hour to sign users out of current Gmail sessions; other applications vary. Record the action time and verify the outcome instead of assuming immediate containment.
How Hexnode supports access policy hardening
Hexnode IdP supports Conditional Access based on user identity, device compliance, and security context. Device-compliance information from Hexnode UEM and supported Verified BYOD checks help establish whether devices meet organizational access requirements. When a policy requires verified device compliance, an authentication request that cannot satisfy that requirement should be denied before the IdP issues a SAML assertion. Validate this behavior against the intended application and authentication flow before claiming protection against reverse-proxy phishing.
When Google Workspace is federated with Hexnode IdP as its third-party SAML 2.0 identity provider, Hexnode handles authentication for users and sign-in flows covered by that configuration. Google Workspace relies on the resulting SAML assertion to establish application access. Confirm federation assignments, enforce supported device-trust requirements, and test permitted and denied sign-ins before expanding deployment.
Hexnode IdP’s Session Management provides inactivity policies for IdP sessions. These timeouts do not prevent live credential relays or automatically invalidate Google-issued application cookies. For compromised Google sessions, terminate the associated IdP SSO session, then reset the user’s sign-in cookies through the Google Workspace Admin Console. Review and revoke unauthorized OAuth access separately.
Pair device-aware access policies with phishing-resistant authentication and tested containment procedures. Do not assume that changing an IdP policy revokes an existing Google session.
FAQs
How did the phishing campaign targeted by Operation CloudFire bypass Google MFA?
The campaign disrupted by Operation CloudFire used adversary-in-the-middle (AiTM) reverse proxies to relay passwords and supported MFA challenges to Google. Victims completed legitimate authentication while attackers captured the resulting sessions. Attackers could then potentially reuse those sessions without repeating MFA, subject to applicable access controls. Operation CloudFire was Material Security’s disruption effort against this campaign.
Can attackers access Google Workspace after a user successfully completes MFA?
Yes. Attackers who capture a valid authenticated session may access Google Workspace resources without completing another MFA challenge, subject to applicable session and access controls. This makes session protection and timely revocation important even when MFA is enabled.
Are security keys more effective than SMS codes against phishing attacks?
Yes. Phishing-resistant security keys provide stronger protection against credential-harvesting and reverse-proxy phishing than SMS or authenticator codes. Google recommends security keys because they help prevent authentication from being completed through fraudulent websites.
Make session containment an operational requirement
Assign ownership for suspicious-session investigations and rehearse containment with the identity and SaaS administrators who can execute it. Pair phishing-resistant authentication with verified access restrictions and OAuth reviews. The operational goal is to reduce unauthorized access and confirm that response actions actually close it. Recheck access after remediation. Document unresolved exposure before restoring access.
Strengthen Google Session Security
Enforce trusted device access, strengthen identity protection, and reduce phishing risks with Hexnode.
Content writer at Hexnode. Fueled by good coffee and the occasional cat cuddle, I enjoy crafting content that informs, connects, and resonates. Nothing excites me more than knowing my words have been read, appreciated, and maybe even bookmarked.
