Plan
active
Google Calendar phishing campaign hijacks sessions, bypasses MFA
- Engineer — Learn: No patch target here — the attack abuses trusted Google services and legitimate redirect chains to steal sessions post-MFA. Use this to inform a review of phishing-resistant MFA (FIDO2/passkeys) adoption in Google Workspace and session-lifetime policy tightening.
- SOC/IR — Plan: The technique (Calendar invite → trusted redirect → fake login → session cookie theft) is well-documented enough to build Workspace audit-log detections for anomalous OAuth token issuance and login events following Calendar invite interactions; no published IOCs yet to sweep against.
- Leader — Learn: This campaign illustrates that standard TOTP/push MFA does not stop session-hijacking phishing, which is relevant when reporting MFA coverage as a control to auditors or the board; note the gap in the risk register and revisit phishing-resistant MFA roadmap.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.