Hackers Use Fake Google Calendar Invitations to Steal Business Accounts and Sensitive Information
Cybercriminals are using fake Google Calendar invitations to trick employees into giving away access to their Google accounts. A recent phishing campaign has been targeting businesses by sending invitations that appear to come from people or organizations the recipients already know. Once someone clicks on the invitation and enters their login information, attackers can steal access to their account without the victim realizing what has happened.
The campaign, which researchers discovered in August 2026, uses ordinary-looking messages to avoid raising suspicion. Some invitations appear to be voicemail notifications, payment reminders, requests for business proposals, or even legal notices. Because these messages look like normal business communications, employees may be more likely to open them without questioning whether they are legitimate. In some cases, the invitations are sent from email accounts that hackers have already taken over, making them appear even more trustworthy.
What makes this attack especially concerning is that the links often appear to be legitimate Google links. Instead of sending victims directly to an obviously suspicious website, attackers use Google’s own link-sharing and redirect features to send people to a fake sign-in page. This can make it much harder for traditional security tools to recognize the message as dangerous.
When someone clicks the link, they are taken to a page that looks almost exactly like Google’s real login screen. The attackers use a technique that allows their fake page to communicate with the real Google sign-in system in real time. This means that when a victim enters their password, the attackers can capture it while also passing the information along to Google. Even if the user receives a security code on their phone or approves a login request through an authentication app, the attackers can capture that information as well. This can allow them to get around security protections that are normally designed to prevent unauthorized account access.
The danger does not stop once attackers gain access to someone’s Google account. A stolen login session can give them access to much more than email. Depending on the account’s permissions, they may also be able to view files stored in Google Drive, read business communications, and approve access to other applications connected to the account. This could expose confidential company information and create opportunities for additional attacks against the organization.
Researchers also discovered that the attackers worked hard to avoid being detected. They frequently created new websites and internet addresses, sometimes just days before launching an attack. They also used legitimate services to make their links appear safe. This allowed the campaign to get around many of the security checks businesses normally rely on to identify suspicious emails and websites.
The investigation, known as Operation CloudFire, involved tracking the campaign and working with Cloudflare to shut down hundreds of websites used in the attacks. During one month of the operation, researchers reported blocking more than 68,000 malicious messages, analyzing over 2,100 suspicious links, and taking down 897 malicious domains. They also identified more than 8,500 compromised email addresses that were being used to spread the invitations.
Although the attackers have shifted some of their activity from Google Calendar invitations to Google Drive file-sharing notifications, researchers believe the campaign could return using different methods or even target other popular services. The group also appears to have prepared technology that could potentially be adapted to imitate Microsoft 365 login pages, raising concerns that Microsoft users could become future targets.
This campaign is a reminder that not every dangerous email looks suspicious. Even a message that appears to come from Google or someone you regularly communicate with could be part of a scam. Employees should be cautious when clicking links in unexpected calendar invitations, payment notifications, and file-sharing messages. Rather than trusting a message simply because it looks familiar, users should verify unexpected requests directly with the person or organization that supposedly sent them.
Businesses should also monitor account activity for unusual login sessions and make sure they can quickly remove unauthorized access if an account is compromised. Strong security practices, employee awareness, and regular monitoring are important in preventing these types of attacks. As cybercriminals continue finding new ways to make scams look legitimate, taking a few extra seconds to verify an unexpected message could help prevent a much larger security problem.
