# Operation CloudFire: Google Calendar Phishing Campaign Hijacks Sessions and Bypasses MFA via Live Reverse Proxy (Nyasher)

> Since mid-August 2026, Google Calendar invites with mundane pretexts (voicemail notifications, RFP/RFI requests, court summonses, missed payments) have lured corporate Google Workspace users to a live proxy of the genuine Google sign-in page that relays passwords and every MFA method in real time. Material Security reports 68,676 messages blocked, 2,112 unique malicious URLs analyzed and 897 domains taken down; the campaign uses the publicly documented Nyasher framework.

- **Published:** 2026-11-04T15:19:19Z
- **Last reviewed:** 2026-11-06T06:30:30.617Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5245
- **ID:** TL-2026-5245
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)

## Description

Operation CloudFire is the name Material Security's threat research team gave to a phishing operation active since mid-August 2026 that steals live Google sessions instead of static passwords. Lures arrive as Google Calendar invites, frequently sent BCC from previously-contacted organizations whose mailboxes were compromised (Material counted 8,570 compromised sender addresses across 6,354 root domains among its customers). Pretexts are deliberately mundane: voicemail notifications, RFP and RFI requests, court summonses and missed payment notices. Send cadence followed US business hours.

The first hop is a legitimate Google URL: the google.com /url redirector carrying the malicious destination in a query parameter, or share.google / Drive file links. Victims are then shown a Cloudflare Turnstile challenge (sometimes the genuine widget served from Cloudflare). Only after the challenge completes is the password-capture page built dynamically in the browser, so there is no static content for crawlers or scanners; Material states those pages had, to its knowledge, never been scanned by anyone. Behind this sits a live reverse proxy / remote-stream in front of the genuine Google sign-in page. The operator watches the victim in real time and relays SMS codes, authenticator codes, Google Tap-Yes number matching and phone-based account recovery to Google as each arrives, defeating all second factors.

A live Google session reaches mail, Drive and the ability to grant OAuth access in the victim's name, so the blast radius extends well beyond the inbox. Because the outcome is a hijacked session rather than a stolen password, the evidence appears in Workspace audit logs. Infrastructure is disposable: nine lure domains across five registrars were documented in Material's write-up, most registered days before use, receiving endpoints staged 1-20 days ahead, and one wildcard certificate issued 46 minutes before its domain was registered. Reputation feeds scored ownership rather than intent and missed the campaign.

The framework is Nyasher, publicly documented since February 2026 after a hardcoded key was found in its JavaScript. Independent third-party analyses (ZeroBec, Surface Security) of Nyasher samples describe the kit mechanics: Webflow and Cloudflare Workers hosting, press-and-hold / fake-CAPTCHA gating, blob: URL delivery of the credential page, DevTools detection, AES-GCM-encrypted WebSocket C2 and live-streamed frames of accounts.google.com (AVIF in Dec 2025/Feb 2026 samples, WebP in a June 2026 sample). Those samples are Nyasher-family evidence; the sources do not state that they are the same operator or campaign as CloudFire, so related IOCs are labelled as such. Material notes the operator's code contains an unfinished Microsoft 365 branch, suggesting a possible pivot, and that activity from this group appears to have dispersed. No named threat actor attribution is stated. Note that the primary article is sponsored content built on vendor telemetry from Material customers only; actual totals are higher.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1586.002 Email Accounts
- T1608.005 Link Target
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1480 Execution Guardrails
- T1497.001 System Checks
- T1622 Debugger Evasion
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1078.004 Cloud Accounts
- T1550.004 Web Session Cookie
- T1114.002 Remote Email Collection
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Operation CloudFire / Nyasher — Connections to Known Nyasher-Family C2 and Lure Hosts** (`TL-2026-5245-SPL-003`)

Detects proxy or DNS activity to Nyasher-family WebSocket C2 hosts (sage.bucking.top, gold.sommiedo.site), the documented Webflow and Cloudflare Workers lure/gate hosts, and workers.dev WebSocket paths. Nyasher streams frames of accounts.google.com to the victim over an AES-GCM-encrypted WebSocket, so the C2 channel looks like ordinary HTTPS to a trusted SaaS domain. Note that these IOCs come from Nyasher-family analyses and are not stated to be CloudFire infrastructure.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1573.001, T1583.001, T1583.006, T1608.005
- **Data sources:** proxy:zscalernss-web, dns:stream:dns, DeviceNetworkEvents, DeviceFileEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
```Nyasher-family WebSocket C2 and lure hosts per ZeroBec and Surface Security```
(index=proxy sourcetype=zscalernss-web) OR (index=dns sourcetype="stream:dns") earliest=-24h
| eval target=lower(coalesce(query,url)), actor=coalesce(user,src_ip,src)
| where match(target,"(sage[.]bucking[.]top|gold[.]sommiedo[.]site|proposals-ultra-awesome-site-secure-vie[.]webflow[.]io|invitation-for-proposal-submission-m4wg[.]w-hne4jz[.]workers[.]dev|super-dash-787[.]martin1jones890[.]workers[.]dev|zen-grid-6142[.]marcoodom41[.]workers[.]dev|bid-notification-rfq-bidccessing-processes-b3p7[.]w-a5h06t[.]workers[.]dev|[.]workers[.]dev/ws)")
| stats count as hits min(_time) as first_seen max(_time) as last_seen values(sourcetype) as sources by actor target
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table actor target sources hits first_seen last_seen
````

### Microsoft KQL

```kql
let nyasher_hosts = dynamic(["sage.bucking.top","gold.sommiedo.site","proposals-ultra-awesome-site-secure-vie.webflow.io","invitation-for-proposal-submission-m4wg.w-hne4jz.workers.dev","super-dash-787.martin1jones890.workers.dev","zen-grid-6142.marcoodom41.workers.dev","bid-notification-rfq-bidccessing-processes-b3p7.w-a5h06t.workers.dev"]);
let nyasher_sha256 = dynamic(["36931f545f5d9dae91eaa8b3c1ed2c8260324b25a24ab800a73d8526923a52cc","b2fbcaaa9d0cf6a1c36b802c6c95fa510a43b45a9e3c625ae040fdb7d2d66d77","6338a3f599bc830a0454430f419d6ab977de9d1a0088acad785f4d2157e9e1a7"]);
union
(
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any (nyasher_hosts) or (RemoteUrl startswith "wss://" and RemoteUrl has "workers.dev")
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Process = InitiatingProcessFileName, RemoteUrl, RemoteIP = tostring(RemoteIP), Source = "network"
),
(
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where SHA256 in (nyasher_sha256)
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Process = FileName, RemoteUrl = FileOriginUrl, RemoteIP = tostring(FileOriginIP), Source = "file"
)
```

### Sigma

```yaml
title: Operation CloudFire Nyasher-Family C2 And Lure Host DNS Query
id: c92d6e18-4b7f-4a35-8d0e-6f1a3b2c7e94
status: experimental
description: Detects DNS queries for Nyasher-family WebSocket C2 domains and the Webflow and Cloudflare Workers lure and gate hosts documented in ZeroBec and Surface Security analyses of the framework behind Operation CloudFire. The framework relays live Google sign-in frames over an AES-GCM-encrypted WebSocket.
references:
    - https://zerobec.com/blog/nyasher-google-account-takeover-webflow-cloudflare-workers
    - https://surface-security.com/blog/nyasher-bitm-remote-stream-phishing-kit
author: Threadlinqs Team
date: 2026/11/04
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1573.001
    - attack.resource-development
    - attack.t1583.001
    - attack.t1583.006
    - attack.t1608.005
logsource:
    category: dns_query
detection:
    selection:
        QueryName|endswith:
            - 'sage.bucking.top'
            - 'gold.sommiedo.site'
            - 'proposals-ultra-awesome-site-secure-vie.webflow.io'
            - 'invitation-for-proposal-submission-m4wg.w-hne4jz.workers.dev'
            - 'super-dash-787.martin1jones890.workers.dev'
            - 'zen-grid-6142.marcoodom41.workers.dev'
            - 'bid-notification-rfq-bidccessing-processes-b3p7.w-a5h06t.workers.dev'
    condition: selection
falsepositives:
    - Security researchers or sandboxes resolving the published IOCs
    - Threat-intel enrichment pipelines that actively resolve indicator lists
level: high

```

**Known false positives:**

- Security researchers or sandboxes resolving the published IOCs
- Threat-intel enrichment pipelines that actively resolve indicator lists

**Tuning notes:** Nyasher infrastructure is disposable and Material reports the activity appears to have dispersed, so treat this as retrospective hunting and refresh the host list from TL-2026-5245 IOC updates. Exclude security-tooling and sandbox source hosts. The generic workers.dev /ws pattern is lower fidelity; drop it if it is noisy.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Operation CloudFire — Inbound Calendar Invite Email With Google Redirector Link To workers.dev / webflow.io (locked: unlock with TL Creds)
- Operation CloudFire — OAuth Grant Within Minutes Of New-IP Google Workspace Sign-in (locked: unlock with TL Creds)
- Nyasher — Endpoint Connections To Family C2 / Lure Hosts or Sample Hash On Disk (locked: unlock with TL Creds)
- Operation CloudFire — Browser Navigation To Atlassian External Page Or Webflow Site From Google Link (locked: unlock with TL Creds)
- Operation CloudFire — Google Workspace Mailbox Access Burst From New IP After Hijacked Session (locked: unlock with TL Creds)
- Operation CloudFire — Nyasher-Family WebSocket C2 Connection Via Web Proxy (locked: unlock with TL Creds)
- Operation CloudFire — Google Redirector or Calendar Referral to workers.dev / webflow.io Landing Page (locked: unlock with TL Creds)
- Operation CloudFire — New-IP Google Workspace Sign-in With MFA Challenge (Live Proxy Session Hijack) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- Domain: `sage[.]bucking[.]top`
- URL: `hxxps://greenimpact[.]ro/rfp/rfp-portal-access`
- File hash: `36931f545f5d9dae91eaa8b3c1ed2c8260324b25a24ab800a73d8526923a52cc`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Google Calendar phishing campaign hijacks sessions, bypasses MFA (BleepingComputer; sponsored content by Material Security)](https://www.bleepingcomputer.com/news/security/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa/)
- [Reputation Says It's Fine: How Calendar Invites and a Live MFA Proxy Steal Google Sessions (Material Security)](https://material.security/resources/reputation-says-its-fine-how-calendar-invites-and-a-live-mfa-proxy-steal-google-sessions)
- [Nyasher: A Live Google Account Takeover Framework Using Webflow, Cloudflare Workers, and Hidden Admin Telemetry (ZeroBec)](https://zerobec.com/blog/nyasher-google-account-takeover-webflow-cloudflare-workers)
- [Nyasher: The Evasive Phishing Kit That Live-Streams the Real Google Login (Surface Security)](https://surface-security.com/blog/nyasher-bitm-remote-stream-phishing-kit)
- [Google phishing emails (University of York IT Services)](https://www.york.ac.uk/it-services/about/news/2026/google-phishing-emails/)
- [The Identity Breach You Didn't Know You Had: Google Workspace (Huntress)](https://www.huntress.com/blog/identity-breach-google-workspace)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5245