Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign

Since mid-August 2026, a phishing campaign has been stealing live Google sessions from corporate users. Attackers used Google Calendar invites, trusted Google links, and a live reverse proxy in front of the Google sign-in page to relay passwords and second-factor codes to Google in real time and capture the resulting session. Material Security’s Threat Research team tracked the campaign, blocked more than 68,000 messages, and helped take down 897 domains. The campaign currently appears finished, but the source says the infrastructure is cheap to rebuild and the Nyasher framework has been publicly documented.