# Material Security reports 897 domains removed in Google session theft campaign

_Published Wednesday, November 4, 2026 at 11:07 AM EST · Security · Latest · Tier 2 — Notable_

![Material Security reports 897 domains removed in Google session theft campaign — Primary](https://www.bleepstatic.com/content/hl-images/2026/09/22/google-workspace-breach.jpg)

Material Security says its Operation CloudFire disrupted a phishing campaign that used Google Calendar invitations and trusted redirects to steal corporate Google sessions. In a sponsored account, the company reported 897 domains taken down and 68,676 campaign messages blocked over one month.

Attackers placed a live reverse proxy in front of Google's genuine sign-in page, relaying passwords and authentication prompts to capture sessions. Those sessions could reach mail, Drive and OAuth permissions. Material says activity appears to have dispersed and the campaign looks finished, but an unfinished Microsoft 365 branch was also present. Its counts cover only customers who agreed to share data.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa/)

---
Canonical: https://techandbusiness.org/newswire/ic18SbetmbLy9L-WSwQvYi
Published: 2026-11-04T16:07:48.455Z
Story chronology: 2026-11-04T15:00:10.000Z
Retrieved: 2026-11-04T22:05:23.935Z
Publisher: Tech & Business (techandbusiness.org)