Google Calendar Phishing Exploits Live Sessions, Bypasses MFA

How the Scam Works Mechanically

This advanced phishing operation leverages Google Calendar invites as its primary lure, aiming to capture live user sessions rather than just credentials. Attackers send seemingly legitimate invitations for events like voicemail notifications, RFP requests, or payment reminders. These invites often originate from known contacts or trusted domains, making them appear credible. Crucially, the links within these invites initially direct victims through legitimate Google redirectors, Cloudflare challenges, or even trusted third-party services like Intuit. This multi-layered approach ensures that automated security checks and reputation systems return favorable results, masking the malicious intent. The core of the attack involves a reverse proxy positioned in front of a genuine Google sign-in page. When a victim enters their credentials, the attacker's system captures them. More alarmingly, the same system relays multi-factor authentication prompts (such as SMS codes, authenticator app codes, or 'tap yes' approvals) back to Google in real-time. This allows the attacker to complete the authentication process and hijack the live session, effectively bypassing all standard security measures.

Warning Signs & Red Flags

• Unexpected calendar invitations, especially those with urgent or unusual subject matter.
• Links within invitations that initially appear to lead to legitimate services like Google, but then redirect to unfamiliar or slightly altered sign-in pages.
• Requests for immediate action or login after clicking a link in a calendar invite.
• MFA prompts that seem out of place or are received immediately after entering your password.
• Calendar invites sent from a BCC field or from an unexpected sender, even if the domain looks familiar.
• The use of generic or slightly misspelled domain names in the invitation details or links.

How to Protect Yourself & Report

To safeguard against this sophisticated attack, vigilance is key. Always scrutinize calendar invitations, especially those containing links. Be wary of unexpected invites or those requesting immediate action. If a link seems suspicious, do not click it. If you do click and are prompted to log in, carefully examine the URL to ensure it is the legitimate Google login page. Never approve MFA prompts if you did not initiate the login yourself. For corporate users, ensure your organization's security team is aware of such threats and has robust email and calendar security solutions in place. If you suspect you have encountered or fallen victim to this scam, report it immediately to your IT security department. You can also report phishing attempts directly to Google and your email provider. Additionally, reporting suspicious domains and URLs to services like Cloudflare can help disrupt the attackers' infrastructure.