Calendar Invite Phishing: How Google Sessions Get Stolen
Calendar invite phishing is the latest way attackers are stealing logged-in Google sessions, and the victim’s own MFA approval helped the attacker do it. The invites often appear to come from a company you already deal with. If your business runs on Google Workspace, this is worth ten minutes of your attention today.
One note on sourcing. The main article is sponsored content written by Material Security, a vendor that sells email security. Everything below about the campaign is Material’s account, not independent research.
What happened in this calendar invite phishing campaign
According to Material Security, published as sponsored content on BleepingComputer on 4 November 2026, the operation has run since mid-August 2026. The lures arrive as Calendar invites with dull pretexts: voicemail notifications, RFP requests, court summonses and missed payment notices. Most links point to Google itself, usually through its own redirector.
The victim lands on a genuine Google sign-in page, but a live reverse proxy sits in front of it. Material says the proxy relays SMS codes, authenticator codes and Tap-Yes number matching to Google as they arrive, so the attacker keeps the resulting session. Material says the campaign now looks finished, but calls that a status update, not a verdict. It also found an unfinished Microsoft 365 branch in the attackers’ code.
Why it matters if you run a small or mid-sized business
The mechanism is the lesson. This is not a password guess and MFA did not fail. The victim completed MFA on the attacker’s behalf, and the attacker kept the logged-in session, which is a form of spear phishing aimed at a trusted workflow.
Two things made it convincing. First, Material says the invites often came from compromised accounts at organisations the recipient had already corresponded with. A name you know is the strongest lure there is. Second, the links start at google.com, so the usual advice to check the domain does not help.
A live Google session reaches mail, Drive and the ability to grant OAuth access in the victim’s name, according to Material. For a small firm that is the whole business. It is also the starting point for business email compromise, where a trusted mailbox is used to redirect payments.
The control that matters is phishing-resistant MFA. Passkeys and hardware security keys check the real site’s address, so a relay has nothing useful to capture. Ordinary multi-factor authentication is still far better than none, but it is not the finish line. The same human habit also underpins MFA fatigue attacks: approving a prompt because it looks like something you started.
What to do this week
- Ask your IT person to move administrators, finance staff and the owner to passkeys or hardware security keys, which resist this kind of relay.
- Ask them to review how Google Calendar handles invitations from people outside your organisation, because Material says default settings can place invites straight onto a calendar.
- Tell staff never to sign in after clicking a link in an invite or a shared file; open Google in a fresh browser tab and go from there.
- Write down, on one page, how to revoke a user’s sessions, review their OAuth app grants and reset their account, and agree who does it.
- Check who reads your Workspace audit logs, because Material says a hijacked session shows up there rather than in the mail filter.
FAQ
What is calendar invite phishing? According to Material Security, it is a campaign where Google Calendar invites lead to a genuine-looking Google sign-in page behind a live reverse proxy, which relays MFA codes and lets the attacker keep the session.
Does MFA stop it? Not ordinary MFA. Material says the proxy relays SMS codes, authenticator codes and Tap-Yes number matching as they arrive. Passkeys and hardware security keys check the real site’s address, so a relay has nothing useful to capture.
What should a small business do first? Move administrators, finance staff and the owner to passkeys or hardware security keys, then write down how to revoke sessions, review OAuth app grants and reset an account.
How Wolfcore helps
Technical filters struggled here because every link looked legitimate, which leaves people as the last control. Phishy, our phishing simulation, lets you test how staff respond to realistic lures and see who needs help before an attacker does. Find out more at wolfcore.co.uk/phishing-simulation-software, or book a conversation.
Ruben Selby
Founder and Lead Security Consultant, Wolfcore