Operation CloudFire: Google Calendar Phishing Campaign Hijacks Sessions and Bypasses MFA via Live Reverse Proxy (Nyasher)

Key facts

Detection coverage

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5245 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Operation CloudFire / Nyasher — Connections to Known Nyasher-Family C2 and Lure Hosts

Detects proxy or DNS activity to Nyasher-family WebSocket C2 hosts (sage.bucking.top, gold.sommiedo.site), the documented Webflow and Cloudflare Workers lure/gate hosts, and workers.dev WebSocket paths. Nyasher streams frames of accounts.google.com to the victim over an AES-GCM-encrypted WebSocket, so the C2 channel looks like ordinary HTTPS to a trusted SaaS domain. Note that these IOCs come from Nyasher-family analyses and are not stated to be CloudFire infrastructure.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1573.001, T1583.001, T1583.006, T1608.005
• Data sources: proxy:zscalernss-web, dns:stream:dns, DeviceNetworkEvents, DeviceFileEvents
• Severity: high
• Confidence: high

Splunk SPL

```Nyasher-family WebSocket C2 and lure hosts per ZeroBec and Surface Security```
(index=proxy sourcetype=zscalernss-web) OR (index=dns sourcetype="stream:dns") earliest=-24h
| eval target=lower(coalesce(query,url)), actor=coalesce(user,src_ip,src)
| where match(target,"(sage[.]bucking[.]top|gold[.]sommiedo[.]site|proposals-ultra-awesome-site-secure-vie[.]webflow[.]io|invitation-for-proposal-submission-m4wg[.]w-hne4jz[.]workers[.]dev|super-dash-787[.]martin1jones890[.]workers[.]dev|zen-grid-6142[.]marcoodom41[.]workers[.]dev|bid-notification-rfq-bidccessing-processes-b3p7[.]w-a5h06t[.]workers[.]dev|[.]workers[.]dev/ws)")
| stats count as hits min(_time) as first_seen max(_time) as last_seen values(sourcetype) as sources by actor target
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table actor target sources hits first_seen last_seen

Microsoft KQL

let nyasher_hosts = dynamic(["sage.bucking.top","gold.sommiedo.site","proposals-ultra-awesome-site-secure-vie.webflow.io","invitation-for-proposal-submission-m4wg.w-hne4jz.workers.dev","super-dash-787.martin1jones890.workers.dev","zen-grid-6142.marcoodom41.workers.dev","bid-notification-rfq-bidccessing-processes-b3p7.w-a5h06t.workers.dev"]);
let nyasher_sha256 = dynamic(["36931f545f5d9dae91eaa8b3c1ed2c8260324b25a24ab800a73d8526923a52cc","b2fbcaaa9d0cf6a1c36b802c6c95fa510a43b45a9e3c625ae040fdb7d2d66d77","6338a3f599bc830a0454430f419d6ab977de9d1a0088acad785f4d2157e9e1a7"]);
union
(
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any (nyasher_hosts) or (RemoteUrl startswith "wss://" and RemoteUrl has "workers.dev")
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Process = InitiatingProcessFileName, RemoteUrl, RemoteIP = tostring(RemoteIP), Source = "network"
),
(
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where SHA256 in (nyasher_sha256)
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Process = FileName, RemoteUrl = FileOriginUrl, RemoteIP = tostring(FileOriginIP), Source = "file"
)

Sigma

title: Operation CloudFire Nyasher-Family C2 And Lure Host DNS Query
id: c92d6e18-4b7f-4a35-8d0e-6f1a3b2c7e94
status: experimental
description: Detects DNS queries for Nyasher-family WebSocket C2 domains and the Webflow and Cloudflare Workers lure and gate hosts documented in ZeroBec and Surface Security analyses of the framework behind Operation CloudFire. The framework relays live Google sign-in frames over an AES-GCM-encrypted WebSocket.
references:
    - https://zerobec.com/blog/nyasher-google-account-takeover-webflow-cloudflare-workers
    - https://surface-security.com/blog/nyasher-bitm-remote-stream-phishing-kit
author: Threadlinqs Team
date: 2026/11/04
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1573.001
    - attack.resource-development
    - attack.t1583.001
    - attack.t1583.006
    - attack.t1608.005
logsource:
    category: dns_query
detection:
    selection:
        QueryName|endswith:
            - 'sage.bucking.top'
            - 'gold.sommiedo.site'
            - 'proposals-ultra-awesome-site-secure-vie.webflow.io'
            - 'invitation-for-proposal-submission-m4wg.w-hne4jz.workers.dev'
            - 'super-dash-787.martin1jones890.workers.dev'
            - 'zen-grid-6142.marcoodom41.workers.dev'
            - 'bid-notification-rfq-bidccessing-processes-b3p7.w-a5h06t.workers.dev'
    condition: selection
falsepositives:
    - Security researchers or sandboxes resolving the published IOCs
    - Threat-intel enrichment pipelines that actively resolve indicator lists
level: high

Known false positives:

• Security researchers or sandboxes resolving the published IOCs
• Threat-intel enrichment pipelines that actively resolve indicator lists

Tuning notes: Nyasher infrastructure is disposable and Material reports the activity appears to have dispersed, so treat this as retrospective hunting and refresh the host list from TL-2026-5245 IOC updates. Exclude security-tooling and sandbox source hosts. The generic workers.dev /ws pattern is lower fidelity; drop it if it is noisy.

• 🔒 Operation CloudFire — Inbound Calendar Invite Email With Google Redirector Link To workers.dev / webflow.io · unlock with TL Creds
• 🔒 Operation CloudFire — OAuth Grant Within Minutes Of New-IP Google Workspace Sign-in · unlock with TL Creds
• 🔒 Nyasher — Endpoint Connections To Family C2 / Lure Hosts or Sample Hash On Disk · unlock with TL Creds
• 🔒 Operation CloudFire — Browser Navigation To Atlassian External Page Or Webflow Site From Google Link · unlock with TL Creds
• 🔒 Operation CloudFire — Google Workspace Mailbox Access Burst From New IP After Hijacked Session · unlock with TL Creds
• 🔒 Operation CloudFire — Nyasher-Family WebSocket C2 Connection Via Web Proxy · unlock with TL Creds
• 🔒 Operation CloudFire — Google Redirector or Calendar Referral to workers.dev / webflow.io Landing Page · unlock with TL Creds
• 🔒 Operation CloudFire — New-IP Google Workspace Sign-in With MFA Challenge (Live Proxy Session Hijack) · unlock with TL Creds

Indicators of compromise

As of 2026-11-06, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-5245.

Sample indicators (3 of 25)

• Domain: sage[.]bucking[.]top
• URL: hxxps://greenimpact[.]ro/rfp/rfp-portal-access
• File hash: 36931f545f5d9dae91eaa8b3c1ed2c8260324b25a24ab800a73d8526923a52cc

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

Technical analysis

Material Security reports 68,676 messages blocked, 2,112 unique malicious URLs analyzed and 897 domains taken down; the campaign uses the publicly documented Nyasher framework.

Operation CloudFire is the name Material Security's threat research team gave to a phishing operation active since mid-August 2026 that steals live Google sessions instead of static passwords. Lures arrive as Google Calendar invites, frequently sent BCC from previously-contacted organizations whose mailboxes were compromised (Material counted 8,570 compromised sender addresses across 6,354 root domains among its customers). Pretexts are deliberately mundane: voicemail notifications, RFP and RFI requests, court summonses and missed payment notices. Send cadence followed US business hours.

The first hop is a legitimate Google URL: the google.com /url redirector carrying the malicious destination in a query parameter, or share.google / Drive file links. Victims are then shown a Cloudflare Turnstile challenge (sometimes the genuine widget served from Cloudflare). Only after the challenge completes is the password-capture page built dynamically in the browser, so there is no static content for crawlers or scanners; Material states those pages had, to its knowledge, never been scanned by anyone. Behind this sits a live reverse proxy / remote-stream in front of the genuine Google sign-in page. The operator watches the victim in real time and relays SMS codes, authenticator codes, Google Tap-Yes number matching and phone-based account recovery to Google as each arrives, defeating all second factors.

A live Google session reaches mail, Drive and the ability to grant OAuth access in the victim's name, so the blast radius extends well beyond the inbox. Because the outcome is a hijacked session rather than a stolen password, the evidence appears in Workspace audit logs. Infrastructure is disposable: nine lure domains across five registrars were documented in Material's write-up, most registered days before use, receiving endpoints staged 1-20 days ahead, and one wildcard certificate issued 46 minutes before its domain was registered. Reputation feeds scored ownership rather than intent and missed the campaign.

The framework is Nyasher, publicly documented since February 2026 after a hardcoded key was found in its JavaScript. Independent third-party analyses (ZeroBec, Surface Security) of Nyasher samples describe the kit mechanics: Webflow and Cloudflare Workers hosting, press-and-hold / fake-CAPTCHA gating, blob: URL delivery of the credential page, DevTools detection, AES-GCM-encrypted WebSocket C2 and live-streamed frames of accounts.google.com (AVIF in Dec 2025/Feb 2026 samples, WebP in a June 2026 sample). Those samples are Nyasher-family evidence; the sources do not state that they are the same operator or campaign as CloudFire, so related IOCs are labelled as such. Material notes the operator's code contains an unfinished Microsoft 365 branch, suggesting a possible pivot, and that activity from this group appears to have dispersed. No named threat actor attribution is stated. Note that the primary article is sponsored content built on vendor telemetry from Material customers only; actual totals are higher.

MITRE ATT&CK techniques by tactic:

Command and Control

T1071.001 Web Protocols; T1573.001 Symmetric Cryptography

Defense Evasion

T1078.004 Cloud Accounts; T1480 Execution Guardrails; T1497.001 System Checks; T1622 Debugger Evasion

Credential Access

T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle

Collection

T1114.002 Remote Email Collection

Execution

T1204.001 Malicious Link

Lateral Movement

T1550.004 Web Session Cookie

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1583.006 Web Services; T1586.002 Email Accounts; T1608.005 Link Target

Remediation

Immediate actions

• Monitor Google Workspace audit logs for session-hijack evidence (new-device/IP logins immediately after a user clicked a Calendar-linked URL, unexpected OAuth grants)
• Be able to revoke sessions and OAuth grants and contain mail/Drive exposure within one hour of detection
• Block or alert on the Nyasher-family hosts and hashes listed in the IOC set
• Treat Google Calendar invites from external or unfamiliar senders as a dedicated phishing surface

Workarounds

• Restrict Calendar auto-adding of external invitations to known senders
• Revoke third-party OAuth app access for users suspected of compromise and force password reset plus sign-out of all sessions

Longer-term hardening

• Enforce phishing-resistant MFA (FIDO2 security keys / passkeys) for Workspace accounts; SMS, TOTP and number matching are all relayable by a live proxy
• Use multi-signal email/calendar detection combining sender reputation, link-chain resolution through Google /url wrappers, message intent and sending-relationship history
• Alert on SaaS-hosted links (Webflow, workers.dev, Atlassian external pages) unrelated to sender infrastructure in credential workflows
• Review how calendar invites from automatically-added or unknown senders are processed in Workspace settings

Affected and fixed versions

• Google — Google Workspace (Calendar, Gmail, Drive, Google Account sign-in)
  Vulnerable versions: Accounts using SMS, authenticator-app or prompt-based MFA (relayable by live proxy)

Timeline

Last updated 2026-11-06 · revalidated 1× · latest source

• 2025-12-03 Earliest Nyasher-family sample (AVIF frame handling) observed on VirusTotal per ZeroBec analysis.
• 2026-02-07 Public disclosure by DarkMarc of a similar Google-focused live-stream phishing operation, cited by ZeroBec.
• 2026-02-27 Second Nyasher sample with enhanced anti-analysis features; the framework is publicly documented as Nyasher during February 2026 after a hardcoded key was found in its JavaScript.
• 2026-06-29 Later Nyasher sample moves to WebP frame handling with embedded cached configuration and runtime C2 selection, targeting a US property business.
• 2026-07-01 Surface Security documents a July 2026 Nyasher browser-in-the-middle sample using a 'Bid Notification' lure (exact day not stated; month start used).
• 2026-08-15 Operation CloudFire calendar-invite campaign begins in mid-August 2026 per Material Security (exact day not stated).
• 2026-09-25 Material Security's Threat Research team runs Operation CloudFire over roughly one month, reporting gateway and backend URLs to Cloudflare, which applies phishing interstitials; 897 domains taken down (approximate date).
• 2026-09-30 Material Security publishes its companion whitepaper (CalendarInviteWhitepaper-sep2026) with the technical breakdown and reportedly indicators (approximate date; the PDF was not parsed).
• 2026-10-28 Material's follow-up reports lures shifted to Google Drive document-share invitations and that campaign activity appeared to have dispersed.
• 2026-11-04 BleepingComputer publishes Material Security's findings: 68,676 messages blocked, 2,112 URLs analyzed, 897 domains taken down; activity appears to have dispersed.

Update history

• 2026-11-06 — CloudFire: Google Calendar invitation phishing uses Nyasher reverse proxy to steal authenticated Google sessions and defeat MFA: What changed No severity, exploitability or status change. The campaign is reported to have shifted lures to Google Drive document shares by late October 2026, and Intuit notifications are reported as an additional redirect path.

Sources cited

• Google phishing emails (University of York IT Services) york.ac.uk · Advisory
• Reputation Says It's Fine: How Calendar Invites and a Live MFA Proxy Steal Google Sessions (Material Security) material.security · Vendor report
• Nyasher: A Live Google Account Takeover Framework Using Webflow, Cloudflare Workers, and Hidden Admin Telemetry (ZeroBec) zerobec.com · Research
• Nyasher: The Evasive Phishing Kit That Live-Streams the Real Google Login (Surface Security) surface-security.com · Research
• The Identity Breach You Didn't Know You Had: Google Workspace (Huntress) Huntress · Blog
• Google Calendar phishing campaign hijacks sessions, bypasses MFA (BleepingComputer; sponsored content by Material Security) BleepingComputer · News · 2026-11-04

More in phishing

• Lookalike Microsoft Teams domains delivered via search ads, AI search answers and SEO poisoning (no phishing email)
• 2026 FIFA World Cup Scam Wave: 35,000+ Fake Ticket, Shop and Streaming Sites
• Microsoft Teams Phishing via Fake IT Helpdesk Impersonation (External Tenant Social Engineering)
• Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting

Previous and next in phishing

• Green Proxy: Undocumented Microsoft 365 AiTM Phishing-as-a-Service Platform Previous report
• Phishing Campaigns Bypass Microsoft 365 RejectDirectSend via Empty SMTP Envelope Sender (MAIL FROM:<>) Next report