Security AlertHigh
Google Calendar phishing campaign steals sessions and bypasses MFA
Nov 4, 2026 · Summarized by Fundy Tech from BleepingComputer
The 30-second version
A phishing campaign used Google Calendar invites, redirects and fake login pages to hijack Google sessions and bypass MFA. The article says nearly 900 domains were taken down.
Key points
- The campaign used trusted-looking Google Calendar invites.
- It relied on fake login pages and session hijacking.
- Material Security says it helped take down nearly 900 domains.
Why it matters
This is a reminder that MFA alone is not always enough if a session is stolen. Small businesses should be cautious with calendar invites and login prompts. Staff should verify unexpected requests through a separate channel.
Who’s affected: Google Workspace users and corporate sessions
What to do
- Verify unexpected Google login prompts another way.
- Review calendar invite links before clicking.
- Train staff to report suspicious redirects.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.