# Attackers Used Google Calendar Invites and Live Proxies to Steal Corporate Google Sessions

*Thursday, November 12, 2026 at 12:08 PM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-12T12:08:11.332Z (47m ago)
**Category**: cyber | **Region**: Global
**Importance**: 7/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/23261.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: A phishing campaign detailed by security researchers abused trusted‑looking Google Calendar invites and live phishing proxies to grab authenticated Google sessions from corporate users, even after real multi‑factor prompts, with 897 attacker domains now taken down.

A newly disclosed phishing campaign shows how routine Google Calendar invites can be turned into a way to break into corporate Google accounts.

According to a technical report highlighted by The Hacker News, attackers sent Google Calendar invitations that contained trusted‑looking Google links. When targets clicked through, their traffic was quietly routed through live phishing proxies—servers that relayed data in real time between the user and Google.

Those proxies captured session cookies and other authentication data after users entered their passwords and approved legitimate multi‑factor authentication (MFA) prompts. Session cookies are tokens that tell services such as Google that a user has already passed the login checks. With those in hand, attackers could open the victims’ Google sessions on their own systems without having to repeat the MFA step.

The campaign focused on corporate Google environments, aiming at Google Workspace accounts that often hold business email, documents and administrative tools. By hijacking authenticated sessions, the attackers sidestepped defenses that assume MFA at login will block most account‑takeover attempts.

Investigators linked the operation to 897 attacker‑controlled domains, which have now been taken down, according to the report. These domains helped make the malicious infrastructure look like normal web traffic tied to calendar events and Google services.

The incident underlines how phishing tactics are evolving from crude fake login pages to techniques that piggyback on legitimate login flows and familiar collaboration tools. It also shows that organizations relying heavily on Google services need to pay attention not only to passwords and MFA, but also to how session tokens are issued, stored and invalidated.

Signals to watch include any changes Google makes to session handling or warnings on calendar‑based links, updated best‑practice guidance for enterprise Google admins, and signs of similar campaigns targeting other cloud platforms using calendar or collaboration invites as lures.