Google Calendar Phishing Campaign Bypasses MFA

Since mid-August 2026, attackers used Google Calendar invites to hijack corporate sessions by bypassing multi-factor authentication. Material Security's Operation CloudFire blocked 68,676 messages and took down 897 domains. The campaign targeted 8,570 unique compromised sender addresses across 6,354 root domains within one month before dispersing.