Security researchers at Material Security tracked a phishing campaign that has targeted business Google accounts since mid-August 2026. Instead of a typical email, the attack often arrived as a Google Calendar invite. Many came from an organization the recipient had already exchanged messages with, because the attackers had taken over those senders' accounts first. Over one month, researchers counted 8,570 compromised sender addresses across 6,354 domains, and they say the real totals are higher.
The invites used ordinary-sounding reasons to click: a voicemail notice, a request for proposal, a court summons or a missed payment. The links usually started on Google's own web addresses, such as Google's redirect links, share.google or Google Drive files. One version used Intuit transaction notices. Because the first link pointed to a trusted company, email filters and careful readers had little reason to be suspicious.
The link eventually led to a copy of the real Google sign-in page sitting behind the attacker's server, a setup called a reverse proxy. The victim typed their password and approved the multi-factor authentication (MFA) prompt as usual, whether that was a text code, an authenticator code or a tap-to-approve request. The attacker passed each step through to Google in real time and kept the logged-in session for themselves. That gave them access to email, Drive files and the ability to approve outside apps in the victim's name.
Researchers say the campaign now appears to have wound down, with lures shifting to Google Drive file share invites. However, the tools behind it are publicly known and cheap to rebuild, and the attackers had already prepared an unfinished version aimed at Microsoft 365 sign-ins. Businesses on either platform should expect similar attacks in the future.
The key lesson is that MFA is still very valuable, but it is not a guarantee. A sign-in page that looks right, reached through a link that starts on a trusted site, can still be a trap. Being able to quickly spot and shut down a hijacked session matters as much as preventing the first click.
What you should do
- Treat unexpected calendar invites and file shares with links about voicemails, payments, legal notices or proposals with caution, even from known contacts.
- Confirm unusual requests by calling the sender at a number you already have, not one in the message.
- Go to your Google or Microsoft account directly by typing the address yourself rather than signing in through a link in an invite.
- Make sure someone knows how to sign out all active sessions, reset the password and remove unknown connected apps if an account is compromised.
- Ask Computech to review your Google Workspace or Microsoft 365 alerts and sign-in logs so suspicious sessions are noticed quickly.
Computech prepares these summaries with AI assistance, based on public news reports. See the original report for full details.
