Material launched Operation CloudFire to fight the calendar phishing campaign shared earlier in October.
Material took down 897 domains behind the calendar invite session-hijacking campaign. Here is how Operation CloudFire worked, what the attacker did inside a compromised account, and where the campaign stands.
Where we left it
Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users, using Google Calendar invites as the delivery mechanism and a live proxy in front of the real Google sign-in page as the capture mechanism. We described that methodology in our original research, Reputation Says It's Fine: How Calendar Invites and a Live MFA Proxy Steal Google Sessions, and the full technical breakdown, indicators, and timeline are in the companion whitepaper.
At the end of August, this looked like a single note in the general noise of malicious email. By the first week of September it was clearly a much larger campaign than it first appeared. Lure domains were coming back clean in every commercial reputation feed we checked, the capture page did not exist until a browser built it, and the receiving endpoints were bought to be thrown away. Blocking any single piece of that costs the operator a few dollars and an afternoon.
From detection to disruption
By the end of September we had decided that adjusting rules, tuning ML detection models, and updating agents was not the whole job. Detection keeps our customers safe. It does nothing about the operator who is still standing up the next wave.
So Material's Threat Research team launched Operation CloudFire. The idea was to attack the other side of the problem: analyze the gateway and backend URLs the actors were using as the messages were actually being sent, and report that infrastructure through Cloudflare's abuse reporting system. When Cloudflare's abuse team validated the fake interstitial and the proxied Google sign-in page behind it, they applied their own phishing interstitial to the destinations.
That had two intended effects. First, it burned the attacker's infrastructure: every gateway and receiving endpoint we reported had to be re-registered, re-pointed, and re-certified before the operator could send again. Second, it protected the wider internet population, not just Material's customers. Anyone who clicked a reported link from anyone else's inbox now met a warning page instead of a credential capture form.
The month in numbers
This data is taken from customers that have agreed to share data with Material, so some of the numbers are much lower than the actual. Over the course of a month of Operation CloudFire:
- 68,676 campaign messages blocked.
- 2,112 unique malicious URLs analyzed.
- 897 unique domains taken down.
- 8,570 unique compromised sender addresses observed, from 6,354 root domains.
- Send cadence followed US business hours.
Working backwards from the sender list, Material observed 8,570 unique compromised addresses across 6,354 root domains carrying these messages. Each one was an account the attacker already owned before the first invite went out, and each one mailed the victim's saved addresses next along with other targets. The recipient therefore met a name they had worked with or a recognizable domain with a clean history, at an hour that looked correct for the relationship. Reputation feeds had no reason to flag any of it, so every layer of the chain that scores ownership and history returned a reassuring answer.
Where the campaign stands now
We observed the phishing themes themselves change, from calendar invites to Google file and document share invites, but we have not seen a corresponding increase in other themes or TTPs. Activity from this group of attackers appears to have dispersed, and the campaign has seemingly ended.
That is a status update, not a verdict. The infrastructure is cheap to rebuild, the framework has been public since February under the name Nyasher, and, as we noted in our first post, the operator shipped an unfinished Microsoft 365 branch alongside the live Google code. The theme rotation we watched over September is the behavior of someone iterating, not someone retiring. If the next pivot comes, it will look like this one with the brand changed.
