{"id":2543,"date":"2026-11-06T14:48:55","date_gmt":"2026-11-06T09:18:55","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=2543"},"modified":"2026-11-06T16:50:52","modified_gmt":"2026-11-06T11:20:52","slug":"operation-cloudfire-mfa-bypassing-phishing-campaign-targets-corporate-google-sessions","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/operation-cloudfire-mfa-bypassing-phishing-campaign-targets-corporate-google-sessions\/","title":{"rendered":"Operation CloudFire: MFA-Bypassing Phishing Campaign Targets Corporate Google Sessions"},"content":{"rendered":"

The Operation CloudFire phishing MFA bypass findings describe an adversary-in-the-middle (AiTM) campaign targeting corporate Google sessions. Material Security tracked the phishing activity from mid-August 2026 and launched Operation CloudFire to disrupt the attackers\u2019 infrastructure. The campaign captured authenticated sessions while victims completed legitimate MFA challenges.<\/p>\n

For enterprise security teams, the incident highlights a specific gap: completing MFA does not establish that subsequent session activity belongs to the legitimate user. Protecting access requires stronger authentication, appropriate access policies, and tested account containment procedures.<\/p>\n

Operation CloudFire phishing MFA bypass explained<\/h2>\n

The attack began with Google Calendar invitations, often from organizations recipients recognized. Links used trusted Google redirects before leading victims through a challenge page to an attacker-controlled sign-in flow.<\/p>\n

A live reverse proxy relayed interactions with Google\u2019s genuine authentication service. Victims entered passwords and completed real MFA challenges while attackers captured the resulting authenticated sessions. Material reported support for SMS codes, authenticator codes, and Google\u2019s number-matching prompts.<\/p>\n

The capture interface assembled in the browser after the challenge, complicating static inspection. Attackers also rotated disposable infrastructure across registrars. A trusted initial URL therefore provided little assurance about the final destination.<\/p>\n

Lures later shifted toward Google file and document sharing. In its October 28 update, Material reported 897 domains taken down and 68,676 messages blocked over one month. These figures covered participating customers. Researchers said activity appeared to have dispersed and the campaign seemingly ended, while warning that attackers could rebuild.<\/p>\n

\n
\n
\n
\n \"cybersecurity-kit\"\n <\/div>\n <\/div>\n
\n
\n Featured Resource\n <\/h5>\n

\n Cybersecurity kit\n <\/h4>\n

\n Access essential cybersecurity resources to strengthen security, reduce risk, and improve cyber resilience.\n <\/p>\n \n Download the Resource Kit\n \n \n \n \n <\/g>\n <\/svg>\n\n <\/a>\n <\/div>\n <\/div>\n <\/section>\n

Why compromised sessions create broader enterprise exposure<\/h2>\n

A hijacked Google session can expose Gmail and Drive and enable OAuth authorization in the user\u2019s name, subject to applicable controls. Responders should therefore investigate connected applications and file activity alongside mailbox access.<\/p>\n

For example, a compromised employee account could expose project documents and support convincing follow-up messages to colleagues. Treat this as a potential account takeover requiring investigation, even when the user remembers approving a legitimate-looking authentication prompt. Assess the permissions and data available to that specific account.<\/p>\n

MFA remains valuable, but authentication methods differ. Google recommends security keys over verification codes for stronger phishing protection. Prioritize phishing-resistant authentication for administrators and other high-risk users, while reviewing recovery options that could weaken the intended protection.<\/p>\n

Responding to Operation CloudFire phishing MFA bypass risks<\/h3>\n

To reduce automatic calendar additions from unfamiliar senders, open Google Calendar > Settings > Event settings > Add invitations to my calendar and select Only if the sender is known. This setting does not block invitations from compromised known senders or prevent invitation emails from arriving.<\/p>\n

Use Google\u2019s compromised-account guidance to build a response procedure:<\/p>\n