Material Security found a campaign it calls Operation CloudFire, harvesting live Google sessions from corporate users since mid-August, BleepingComputer reports. It has taken down hundreds of domains.
How it works
- Google Calendar invites, sometimes BCC’d and often from an organization you’ve emailed before. The lures are voicemails, RFPs, court summonses and missed payments
- Links go through Google’s own /url redirector, share.google or Drive, so the domain and reputation look trusted
- A Cloudflare Turnstile challenge, then a page built in your browser with JavaScript, so scanners have nothing to fetch
- A live reverse proxy in front of the real Google sign-in relays your password, SMS or authenticator code, and even Tap-Yes number matching. It’s built on the Nyasher framework
My take
Codes and push prompts don’t stop a real-time proxy. Passkeys and hardware security keys do, because they’re bound to the real domain. Treat surprise calendar invites like email from strangers.
God Bless, and May the Source Be with You!
