Security AlertHigh
Google session hijacking campaign uses Calendar invites and live proxies
Nov 12, 2026 · Summarized by Fundy Tech from The Hacker News
The 30-second version
A phishing campaign has stolen live Google sessions from corporate users since mid-August 2026. The attackers used Calendar invites and live reverse proxies to capture logins and second factors.
Key points
- Campaign has run since mid-August 2026.
- Messages often arrive as Google Calendar invites.
- Attackers used live reverse proxies in front of Google sign-in.
- Material Security says it took down hundreds of attacker domains.
Why it matters
If workers use Google accounts for email, documents or admin tasks, a hijacked session can expose business data without a password reset stopping it right away. Training staff to question Calendar invites and login prompts can help reduce risk.
Who’s affected: Corporate Google users
What to do
- Warn staff about Calendar invite phishing.
- Review Google account security settings.
- Use multi-factor authentication and watch for unusual session activity.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.