Actor Profile

Operation CloudFire is a phishing campaign active since mid-August 2026 that targets corporate Google Workspace users. The operation demonstrates sophisticated understanding of defensive blind spots and employs disposable infrastructure designed to evade reputation-based and static detection systems. The campaign's operators leverage trusted platforms (Google Calendar, Google URL redirectors, Cloudflare services) to establish legitimacy and use the Nyasher reverse-proxy framework to capture live authenticated sessions in real time. Motivation appears to be corporate credential harvesting and session hijacking for unauthorized access to enterprise Google Workspace environments including email, Drive, and OAuth-enabled applications.

TTPs (Tactics, Techniques, Procedures)

Initial Access: Phishing via Google Calendar invites (T1566.002 - Spearphishing Link) using pretexts such as voicemail notifications, RFP requests, court summonses, and payment notices. Credential Access: Adversary-in-the-middle attack (T1557) using Nyasher reverse-proxy framework positioned in front of legitimate Google sign-in pages to intercept credentials and session tokens (T1539 - Steal Web Session Cookie). The proxy relays all MFA challenges in real time including SMS codes, authenticator tokens, Google Tap-Yes prompts, and phone-based recovery. Defense Evasion: Multi-layered obfuscation using trusted Google URL redirectors (T1204.001 - User Execution: Malicious Link), Cloudflare Turnstile challenges, and dynamic JavaScript construction of phishing pages to evade static scanning (T1027 - Obfuscated Files or Information). Rapid infrastructure rotation with domains registered days before use and wildcard certificates issued minutes before deployment (T1583.001 - Acquire Infrastructure: Domains). Persistence: Hijacked live Google sessions provide access to Gmail, Google Drive, and ability to grant OAuth permissions in victim's name (T1550.001 - Use Alternate Authentication Material).

Targets & Patterns

Operation CloudFire specifically targets corporate and enterprise users of Google Workspace. The campaign exploits organizational trust relationships by sending Calendar invites from organizations the recipient has previously corresponded with, often via BCC to reduce visibility. The selection of pretexts (RFPs, court documents, payment notices) suggests targeting of business users likely to engage with such communications in their professional capacity. The focus on Google Workspace environments indicates the operators are pursuing high-value corporate data accessible through compromised sessions: email archives, shared documents in Drive, and the ability to establish persistent OAuth access. The use of Calendar invites as the delivery mechanism is particularly effective against enterprises that may have strong email gateway controls but treat calendar functionality as a lower-risk surface. The campaign's sophistication and infrastructure investment suggest targeting of organizations with mature security programs that rely on reputation-based defenses and MFA, which this operation is specifically designed to bypass.

Historical Context

The Nyasher reverse-proxy framework used in Operation CloudFire has been publicly documented since February 2026, following discovery of a hardcoded key in its JavaScript. This framework enables real-time adversary-in-the-middle attacks against authentication flows, relaying all forms of multi-factor authentication including SMS, authenticator apps, and push notifications. Operation CloudFire represents an evolution in phishing tradecraft by combining this known MFA-bypass capability with novel abuse of trusted platform features (Google Calendar, URL redirectors) and dynamic page construction to evade static analysis. Material Security began tracking this specific campaign in mid-August 2026 and launched infrastructure disruption efforts (Operation CloudFire response) in late September 2026 after concluding that detection alone was insufficient. Through collaboration with Cloudflare's abuse team, Material has taken down nearly 900 malicious domains associated with the campaign. The operation demonstrates a trend toward "living off trusted platforms" where attackers chain legitimate services to establish credibility while the actual malicious payload remains ephemeral and difficult to analyze through traditional scanning methods.

Defensive Recommendations

  • Monitor Google Workspace audit logs for anomalous session creation patterns, particularly sessions originating from unexpected geolocations or ASNs immediately following calendar invite acceptance (T1557, T1539)
  • Implement calendar invite inspection capabilities that analyze embedded links for redirect chains and evaluate final destinations, not just first-hop domains; treat calendar as an equal threat surface to email
  • Deploy behavioral analysis that correlates calendar invite delivery with subsequent authentication events within short time windows (minutes to hours) to identify potential session hijacking attempts
  • Establish incident response procedures for rapid session revocation, OAuth grant review and revocation, and account containment within one hour of suspected compromise, as live sessions provide immediate access to email, Drive, and delegation capabilities
  • Evaluate security controls that can analyze dynamically constructed JavaScript content and follow multi-stage redirects through CAPTCHA/challenge pages, as static reputation and URL analysis alone cannot detect this campaign's infrastructure