A scam using fake Google Calendar invites has been capturing live work sign-ins since August, and 2-step codes do not stop it. Here is how it works.
A phishing campaign that began in mid-August 2026 is hijacking Google work accounts through fake Google Calendar invites. The trick works even when a person uses 2-step verification, the extra code or prompt many people rely on. Security firm Material Security tracked the campaign and calls its response Operation CloudFire.
The invites often look like they come from an organization the target has dealt with before. Some arrive by BCC, which hides the other recipients. The stories are everyday ones. A voicemail waiting for you. A request for a bid. A court summons. A missed payment.
The links inside do not look suspicious, because most of them point to Google itself. Others used Google Drive file links or Intuit notification links. When security tools check them, the domain and reputation look legitimate.
The link eventually leads to a fake page that sits in front of the real Google sign-in. The victim types a password, gets a real prompt from Google, and approves it. The attacker watches all of this live and passes each step along to Google as it happens.
That includes text message codes, authenticator app codes, the Tap-Yes number match, and phone-based account recovery. Because the real Google is answering, every check passes, and the attacker ends up holding the signed-in session.
The password page is also built inside the visitor's browser after a security challenge is cleared. That leaves automated scanners almost nothing to inspect. The attackers also use throwaway domains, many registered only days before use.
A live Google session can reach email and Drive files. It can also be used to grant other apps access in the victim's name. Material notes that the damage reaches well past the inbox, and that an attacker with a live session can do a great deal in an hour.
The reports focus on people who use Google at work, including Workspace, Gmail, Calendar and Drive. The material does not say whether personal accounts are also being hit. Nobody is safe just because they use 2-step verification, but a person who never follows links in unexpected invites avoids the trap. The steps in the alert box above cover what to do, including what to do if you already entered a login.
Material says it has caught over 99% of the malicious messages it has seen since the campaign was identified. Its researchers also reported the attackers' servers to Cloudflare, which put warning pages in front of them. Researchers helped take down nearly 900 domains. The attackers have changed their wording and methods along the way, and the material does not say whether the campaign has ended.
Treat any unexpected calendar invite that asks you to sign in as a trap, and open Google by typing the address yourself.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
