A Google Calendar Invite That Relays MFA and Steals the Session
A Google Calendar invite leads through Google's own links to a live proxy that relays MFA in real time, so the attacker keeps the signed-in Google session.
AegisAI Threat IntelligenceAegisAI Threat Watch · Session hijacking
A Google Calendar Invite That Relays MFA and Steals the Session
A Google Calendar invite from an apparent contact leads through Google's own links to a live proxy that captures the password and MFA in real time.
- What
- A Google Calendar invite from an apparent contact links through Google to a live proxy that relays MFA, so the attacker keeps the session.
- Who it hits
- Corporate Google users, per SC Media. Researchers warn the same method could be pointed at Microsoft 365.
- Why scanners miss it
- Links use legitimate Google redirectors and pages built by JavaScript, so reputation-based tools find nothing to flag.
- Do today
- Monitor Workspace audit logs and confirm sessions can be revoked quickly.
Reported by SC Media, 4 November 2026.
A Google Calendar invite from an apparent contact leads through Google's own links to a live proxy that captures the password and MFA in real time.
Adversary-in-the-middle (AitM) phishing puts a proxy between the victim and the real sign-in page. The victim signs in for real, and the proxy keeps a copy of the session. Session hijacking is what follows: the attacker acts as the signed-in user without needing the password again.
Analysis based on SC Media reporting, 4 November 2026. Threat Watch has also covered a phishing service that keeps stolen Microsoft 365 sessions alive.
Source: SC Media, 4 November 2026.
Key judgments
- The first hop is Google. SC Media reports that the links used legitimate Google redirectors and pages built dynamically by JavaScript, so reputation-based security tools had little to flag.
- MFA is relayed, not broken. A reverse proxy sits in front of genuine Google sign-in pages and lets the operators capture credentials and bypass MFA in real time, so the victim completes a real sign-in.
- The sender looks known. The invites appeared to come from known contacts and used mundane pretexts such as payment notices or document requests. AegisAI's reading is that a familiar sender removes the usual reason to doubt the message.
- Infrastructure is disposable. SC Media reports that domains and certificates were rotated frequently, so a block list built today ages within days.
- Quiet is not over. The campaign appears to have subsided after malicious endpoints were reported to Cloudflare, while researchers warn that the attackers could pivot to Microsoft 365 targets.
Evaluating email security tools? The 2026 Buyer's Guide to Email Security has nine evaluation areas and the questions to ask vendors. Get the guide.
How does Google Calendar invite phishing bypass MFA?
It does not break MFA; it relays it. SC Media describes the campaign in outline. Steps 1 to 4 follow that outline; step 5 is AegisAI's reading of what the operator holds afterwards.
- A Google Calendar invite arrives that appears to come from a known contact, with a mundane pretext such as a payment notice or a document request.
- The link starts at a legitimate Google redirector, so the first destination is a trusted domain.
- The page is built dynamically by JavaScript. AegisAI's reading is that a scanner fetching the link finds no fixed page to judge.
- The victim signs in through a reverse proxy placed in front of the genuine Google sign-in page. The operators capture the credentials and bypass MFA in real time.
- The operator holds a signed-in session. AegisAI's reading is that a session gives access to whatever that user can reach, such as mail and Drive.
Source: SC Media, 4 November 2026. The scanner remark in step 3 and step 5 are AegisAI's analysis.
What a defender sees at each stage
The table lists what each stage looks like from outside and why it passes. It is AegisAI's reading of the reported outline.
| Stage | What is observed | What looks normal about it |
|---|---|---|
| Delivery | A Calendar invite that appears to come from a known contact | A familiar sender with a mundane pretext |
| Link | A legitimate Google redirector | A Google domain with a valid certificate |
| Page | A page built by JavaScript in the browser | No fixed page for a scanner to judge |
| Sign-in | Google's genuine sign-in flow through a reverse proxy | Real prompts, and MFA that succeeds |
How do I spot a hijacked Google account when MFA did not stop the attacker?
Look at the session and what it did, not at the sign-in alone, because the sign-in was genuine. SC Media's advice is to monitor Workspace audit logs and to be able to revoke compromised sessions rapidly.
Three signals follow from the reported outline. This list is AegisAI's reading:
- Calendar invites or mail sent from the account that its owner did not send.
- A sign-in from a new device or location shortly after the user opened an invite.
- OAuth grants or sessions that the user does not recognise.
| Control | What it sees in this campaign | Result |
|---|---|---|
| Link reputation or URL scanning | A Google redirector first, then a page built by JavaScript | Little to score; SC Media reports reputation-based tools were evaded |
| Sender reputation | A message that appears to come from a known contact | Passes |
| SMS, authenticator codes and push approvals | Each factor is completed on the genuine flow through the proxy | Does not stop the session capture |
| Domain blocklists | Domains and certificates rotated frequently | Ages quickly |
| Reading the message and its destination together | An invite from an apparent contact that asks the recipient to sign in | Can be flagged |
| Audit-log monitoring and fast session revocation | The response after a compromise | Limits the window |
AegisAI analysis, except that the first, fourth and last rows follow SC Media's reporting and advice.
The invite looks familiar, the link is Google's and the sign-in is genuine. Only the party in the middle is not.
AegisAI Threat IntelligenceWhat this means for a security team
This section is AegisAI's analysis. The campaign treats the calendar as a delivery channel, and many mail controls assume an invite is low risk. SC Media also reports that the attackers could pivot to Microsoft 365 targets, so Google Workspace is not the only exposure.
Three questions settle the exposure: whether invites from outside the organization reach users' calendars without review, whether the accounts that matter most use sign-in methods that cannot be relayed, and whether sessions and OAuth grants can be revoked quickly. Passkeys and security keys do not hand a code to a look-alike page; that is a general property of origin-bound sign-in, not a finding of this reporting.
Why standard controls miss it
This section is AegisAI's analysis. Link reputation judges a destination at delivery, and here the first destination is Google. Sender reputation passes a message that looks like a known contact. Every second factor works as designed, because the proxy passes each one to the genuine service. What remains is intent: a message from an apparent contact asks the recipient to open a link and sign in, and that request is visible when the invite arrives, before any proxy is involved.
How AegisAI protects against it
AegisAI has not observed this campaign. The reporting does not say whether each invite reached users as an email message or only as a calendar entry, so the approach below is how AegisAI treats a link-bearing message of this shape when it arrives by email. It does not replace monitoring audit logs and revoking sessions in Google Workspace.
AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it. More on how that works: inbound email security.
When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.
How AegisAI stops credential phishing, 48 seconds
Recommendations for defenders
- Treat calendar invites as link-bearing messages: analyse the message, its intent and where its links end together, instead of relying on link reputation (AegisAI analysis).
- Do not treat a Google redirector link as safe by itself; judge where the chain ends.
- Monitor Workspace audit logs, and make sure compromised sessions can be revoked rapidly (SC Media's advice).
- Move the accounts that matter most to passkeys or security keys, which do not give a code to a proxy page (AegisAI analysis).
- Include Microsoft 365 tenants in the same review, since researchers warn of a possible pivot.
FAQ
What is Google Calendar invite phishing that relays MFA?
It is a campaign that SC Media reported on 4 November 2026, active since mid-August 2026 and harvesting live Google sessions from corporate users. Calendar invites that appear to come from known contacts lead through legitimate Google redirectors to a reverse proxy in front of the genuine Google sign-in page.
Can a reverse proxy phishing attack defeat authenticator codes and push approvals?
Yes. SC Media reports that the proxy lets operators capture credentials and bypass MFA in real time. AegisAI's reading is that this works because the victim completes the real sign-in through the proxy, so a code entered or an approval given is valid when it is passed on.
What should I do if I signed in through a suspicious calendar invite link?
SC Media's advice is to monitor Workspace audit logs and be able to revoke compromised sessions rapidly. AegisAI's reading is to revoke the account's active sessions, review any OAuth grants or connected apps that are not recognised, and then reset the credentials.
Why do link scanners miss Google Calendar invite phishing?
SC Media reports that the links used legitimate Google redirectors and pages built dynamically by JavaScript, which evaded reputation-based tools. AegisAI's reading is that a scan of the first link meets a Google domain and no fixed page, so there is little to score.
For researchers
What the reporting does not tell us 4 gaps
Source. This note rests on one public report, an editorial brief by SC Media. No indicators are published in it, so the indicator table is patterns only.
Delivery. How the invites were sent and whether each reached users as an email message or only as a calendar entry is not described.
Mechanics. How the proxy and the JavaScript-built page fit together, and what the operators did with a captured session, is not described.
Status. The campaign appears to have subsided, with no end date given. The Microsoft 365 pivot is a researcher warning, not an observed attack.
Reported indicators 3 patterns
No attacker domains or hashes are published in the source. These are patterns to hunt for, not a blocklist.
| Type | Pattern | Note |
|---|---|---|
| Link | A legitimate Google redirector in an invite link | The reported first hop |
| Page | A sign-in page built dynamically by JavaScript | No fixed page to fetch |
| Infrastructure | Domains and certificates rotated frequently | Treat any domain list as short-lived |
MITRE ATT&CK mapping 4 techniques
This mapping is AegisAI's own reading of the reported behaviour; the source lists no technique IDs. IDs and names were checked against attack.mitre.org on 14 November 2026.
| ID | Name | Use in this campaign |
|---|---|---|
T1566.002 | Phishing: Spearphishing Link | The invite carries a link that starts at a legitimate Google redirector. |
T1204.001 | User Execution: Malicious Link | The recipient opens the link and signs in. |
T1557 | Adversary-in-the-Middle | A reverse proxy sits in front of Google's sign-in page and captures credentials and MFA in real time. |
T1550.004 | Web Session Cookie | Consistent with the operator holding the signed-in session; reuse of the session is not described. |
References 2 sources
- SC Media (4 Nov 2026). Phishing campaign targets corporate Google sessions. Editorial brief by SC Staff. scworld.com
- MITRE ATT&CK. Enterprise techniques T1566.002, T1204.001, T1557 and T1550.004. attack.mitre.org
Every email, investigated.
When a calendar invite from an apparent contact carries a link that starts at Google, see how AegisAI reads the request and where it leads.
Phishing that reaches the inbox, stopped before anyone clicks.
Book a demoRelated posts
More from the AegisAI blog.