Security · High impactFan score 7 · Tier D
Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign
The Hacker News ·
The Brief
- Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users.
- The campaign uses calendar invites and live proxies so that standard link checks come back clean.
- Threat Research at Material Security identified the campaign.
Why it matters
Session hijacking bypasses passwords and can give attackers access to corporate Google accounts even when link inspection tools report nothing suspicious.
Who’s affected
- Corporate Google Workspace users
- Security teams relying on link scanning
Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a link came back clean, and the operator designed it that way on purpose. The Threat Research team at Material Security spotted…
Timeline
Phishing operation begins stealing live Google sessions from corporate users (mid-August 2026, exact day not given in sources)
The Hacker News publishes report on the campaign
The Hacker News
Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign