Breach · high
Google session hijacking campaign uses calendar invites and live proxies
Tier D · Background noise – Good to know
Who’s exposed: Corporate users with Google accounts targeted via calendar invites
Tier D because: Does not hit tech teams
Reach
Attack
Damage
Fix
Exploited in the wild · Full takeover · Secrets exposed
The Brief
- Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users.
- The campaign uses calendar invites and live proxies so that standard link checks come back clean.
- Threat Research at Material Security identified the campaign.
Why it matters
Session hijacking bypasses passwords and can give attackers access to corporate Google accounts even when link inspection tools report nothing suspicious.
The checklist behind the tier
Checklist · 3 of 10 yes
| No | Hits tech teams | Judgment: phishing campaign against corporate Google users; Google itself not breached, so no. |
| No | Core infrastructure | Judgment: a phishing operation abusing Google sessions, not compromise of core infrastructure software. |
| No | Popular tool | Judgment: Google brand is abused via calendar invites; the platform itself is not flawed or compromised. |
| Yes | Exploited in the wild | The Hacker News: a phishing operation has been stealing live Google sessions since mid-August 2026. |
| No | Public exploit | The Hacker News: no published exploit code or proof-of-concept mentioned; it describes a phishing operation. |
| No | Remote, no login | The Hacker News: attack relies on phishing calendar invites, so the victim must interact with a link. |
| Yes | Full takeover | The Hacker News: stolen live sessions let attackers take over corporate Google accounts. |
| Yes | Secrets exposed | The Hacker News: the campaign steals live Google session tokens from corporate users. |
| No | Supply chain | The Hacker News: phishing of users; no legitimate package, update, or build pipeline compromised. |
| No | No fix yet | Not a vulnerability but an ongoing phishing campaign, so no patch applies. |
Timeline
Phishing operation begins stealing live Google sessions from corporate users (mid-August 2026, exact day not given in sources)
The Hacker News publishes report on the campaign
The Hacker News
Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign
Source
Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign ↗ The Hacker News · 2h ago
First seen · 1 source · Full story page · How tiers are decided