Material Security researchers say a phishing campaign active since mid-August 2026 stole live Google sessions via calendar invites, trusted redirects and a reverse proxy in front of Google sign-in. Over one month, Operation CloudFire blocked 68,676 messages and took down 897 domains among organizations sharing data; an unfinished Microsoft 365 branch is waiting.