What Happened
This Google Calendar phishing campaign is hijacking corporate Google sessions and bypassing MFA. For an MSP, a hijacked session can mean data theft, ransomware, and a client that cannot work. The first step is to treat every unexpected calendar invite as a potential attack.
The campaign sends calendar invites that point to trusted redirects. Those redirects lead users to fake Google login pages. When a user enters credentials, the attacker steals the session cookie and bypasses MFA. BleepingComputer reports that Material Security's Operation CloudFire tracked these attacks, blocked malicious messages, and helped take down nearly 900 attacker domains.
A successful session hijack gives the attacker access to email, documents, and calendars. From there they can run internal phishing, steal data, or trigger ransomware. For an MSP, the cost includes incident response hours, client churn, and reputation damage.
The takeaway for MSPs is that phishing is no longer limited to malicious links and attachments. Calendar invites are now a primary vector. You need to treat them with the same caution as email and prepare your clients for that reality.
Timeline
No detailed timeline of this campaign has been published yet. BleepingComputer reported on the campaign on November 4, 2026.
Who Is Affected
Any organization that uses Google Calendar and Google Workspace for corporate email and collaboration is a potential target. The campaign specifically targets corporate Google sessions, meaning businesses, schools, and other organizations that rely on Google's productivity suite.
Corporate sessions are valuable because they have access to email, Drive files, and internal systems. A single compromised session can give an attacker a foothold in the entire tenant. Individual users with personal Google accounts could also be affected if they open a malicious invite.
Small and medium-sized businesses are often the most affected because they rarely have dedicated security teams. An MSP is their security team. That means you need to monitor for these attacks across every client and respond fast when one triggers.
Why This Matters for MSPs
A single hijacked session can compromise an entire client tenant. Attackers use the session to read email, search Drive for credentials, and launch further phishing. For an MSP, the cost is not just the breach, it is the response time, the cleanup, and the client's lost trust. The blast radius depends on how quickly you detect the hijack and revoke the session. That is why monitoring and response playbooks are essential.
This campaign is a reminder that MFA alone is not enough. Session cookies are stolen after authentication, so the attacker never needs to pass MFA again. The defense is to limit session exposure, use phishing-resistant MFA where possible, and have clean backups for recovery.
Technical Details
No CVE has been assigned. The product targeted is Google Calendar, and no specific version is named in the report. The attack vector, as described by BleepingComputer, is a phishing campaign that uses Google Calendar invites, trusted redirects, and fake login pages to hijack corporate Google sessions and bypass MFA protections.
The use of trusted redirects makes it harder for email security filters to classify the message as malicious, because the initial link appears to point to a legitimate domain.
What MSPs Should Do About Google Calendar Phishing
Treat every client as a potential victim. Use these steps to reduce the chance of session hijack and to contain the damage if it happens.
After revoking a compromised session, check for other sessions in the tenant and look for changes to forwarding rules, mailbox rules, and OAuth apps. These are common persistence techniques in session hijacking attacks. Then run a recovery drill to make sure you can restore a client from backup quickly.
- Enable phishing-resistant MFA, such as hardware security keys, for all administrative and high-privilege Google accounts.
- Educate users to treat calendar invites with links as suspicious, especially when the invite comes from outside the organization.
- Review Google Workspace login activity and session data for unusual locations, devices, or times.
- Block or flag emails and calendar invites that contain redirect URLs from known abuse patterns.
- Require users to report unexpected invites so you can investigate before they click.
- Have a recovery plan that includes clean backups of critical data.
How EnterProtect Helps
EnterProtect backup keeps clean, restorable copies of client data and systems. If a session hijack leads to data loss or ransomware, recovery gets a client running again from a known-good state.
EnterProtect vulnerability scanning identifies exposed software versions across your client base. As a standing practice, you can patch those exposures before attackers exploit them. These capabilities help you respond when an attack gets through and keep your clients protected over time.
Frequently Asked Questions
How Does a Google Calendar Phishing Campaign Bypass MFA?
The attacker steals the session cookie after the user logs in on a fake page. Since the user already passed MFA, the session cookie is valid and MFA does not stop the hijack. The attacker then uses that session to access corporate data.
What Is a Trusted Redirect in This Attack?
A trusted redirect is a legitimate URL that silently forwards the user to another page. In this campaign, attackers use trusted redirects to hide the final destination, making the fake login page look more credible.
How Can I Tell If a Google Calendar Invite Is Phishing?
Look for unexpected invites from outside your organization, especially those that contain links or ask you to sign in. Hover over links to see the real destination, and avoid entering credentials on pages you reached from an invite.
What Should I Do If a Client's Google Session Is Hijacked?
Revoke the session immediately from Google Workspace admin, force a password reset, and sign the user out of all devices. Then review account activity for further compromise and restore any affected data from backup.
Does This Attack Affect All Google Calendar Users?
The campaign targets corporate Google sessions, so organizations using Google Workspace are the primary risk. Users who click a malicious invite and complete login are affected, regardless of whether they use a corporate or personal account.
What Are the Signs of a Hijacked Google Session?
Signs include unusual login locations or devices, email forwarding rules you did not create, and calendar entries you did not add. Users may also report that their password stops working. If you see these signs, revoke sessions and investigate.
Sources
- Google Calendar phishing campaign hijacks sessions, bypasses MFA (Bleepingcomputer)