Google Calendar Invites Used to Steal Active Sessions

A phishing campaign is using ordinary-looking Google Calendar invitations to steal passwords and active Google sessions. The attacks observed by Material Security targeted corporate users, but the same warning signs can help anyone protect a Google account that holds email, files and password-reset messages.

What happened

Since mid-August 2026, attackers have sent Calendar invitations disguised as voicemail alerts, court summonses, missed-payment notices and business requests. Some invitations arrived from organizations that recipients had previously emailed, making them appear more trustworthy, according to The Hacker News.

The links often begin on legitimate services, including Google’s own redirect system, share.google or Google Drive. Some versions used Intuit notification links. A click then leads through additional steps, sometimes including a real Cloudflare Turnstile check, before displaying a fake sign-in page assembled inside the browser.

That page acts as a live middleman between the victim and Google. When someone enters a password and approves a real Google prompt, the attacker relays each step immediately and captures the resulting session. The campaign can pass along SMS codes, authenticator codes, Tap-Yes number matching and phone-based recovery prompts. A familiar domain at the beginning of the link therefore does not prove that the final sign-in page is safe.

Material Security said it had taken down hundreds of attacker-controlled domains connected to the operation.

Who is affected

The documented campaign has targeted corporate Google users. The source does not say that personal Gmail accounts have been targeted, how many accounts were compromised or whether the operation focused on the United States.

Still, a stolen Google session can expose Gmail and Drive and may let an attacker authorize other apps through OAuth. Because email receives verification messages and account-recovery links, losing control of it can also put other accounts at risk.

What to do now

1. Treat unexpected Calendar invitations like suspicious email. Do not click links in invitations about voicemails, payments, legal notices or unfamiliar business requests until you confirm the request through a separate channel.

2. Open services directly. If an invitation claims something is waiting in Google Drive or another account, use the service’s normal app or type its known address yourself. Do not rely on the invitation’s link, even when its first address belongs to Google or another familiar company.

3. Stop if a link asks you to sign in again. Close the page and open Google separately. A working security check or genuine-looking Google prompt does not establish that the page behind it is legitimate.

4. Review your Google account after a suspicious sign-in. Click your Google profile picture, choose Manage your Google Account, then open Security. Check recent security activity, signed-in devices and third-party access. Sign out unfamiliar devices and remove access you do not recognize.

5. Change the password from a clean device if you entered it on a suspicious page. Use a new, unique password, then review Gmail and Drive for activity you did not perform. Contact your workplace administrator immediately if the account belongs to an employer.

Consider adding a hardware security key as a dedicated second factor for an important Google account.