Attackers Hijack Google Accounts Without Your Password

Attackers are hijacking corporate Google accounts by stealing live sessions, a method that bypasses multi-factor authentication and other standard security measures.

Material Security's Threat Research team has uncovered a sophisticated phishing campaign they've dubbed "Operation CloudFire." The operation targets corporate users of Google Workspace with a novel approach. According to the report from The Hacker News, the attackers are not trying to steal passwords. Instead, their goal is to hijack active, authenticated Google sessions. This method is deliberately designed to evade the standard security checks that IT teams and savvy users rely on, such as verifying link authenticity. The campaign has been effective enough that security researchers have already worked to take down hundreds of domains associated with the attackers, indicating a widespread and persistent threat. The core danger lies in its subtlety; by all initial appearances, the phishing attempts look legitimate.

This campaign's technical ingenuity lies in its method of bypassing multi-factor authentication (MFA). The attack likely uses a technique known as an adversary-in-the-middle (AiTM) phishing attack. An attacker sends a user a link, perhaps embedded in a deceptive calendar invite, that directs them to a malicious server. This server acts as a reverse proxy, transparently forwarding traffic between the user and the real Google login page. The user sees the familiar Google screen and enters their credentials, including their password and MFA code. Because the proxy sits in the middle, it captures everything, including the valuable session cookie that Google issues after the successful authentication. This cookie is the key. The attacker can then use this stolen cookie to access the user's account from their own machine, effectively inheriting the live session without ever needing the password or MFA token again.

This attack is part of a significant and troubling trend in cybersecurity. For years, the industry has pushed MFA as a critical defense for credential theft. While it remains essential, attackers have adapted. They have shifted their focus from stealing static credentials like passwords to stealing dynamic session tokens. This represents a move "up the stack" from attacking the authentication process to attacking the authenticated session itself. We've seen similar AiTM techniques used in other large-scale campaigns, but Operation CloudFire's specific targeting of corporate Google accounts highlights the high value of this data. It proves that determined adversaries will always find the next logical weak point in a security chain. As long as applications rely on portable session tokens to manage user access, those tokens will be a primary target for theft.

For founders, CTOs, and security teams, Operation CloudFire serves as a critical reminder that security is a moving target. Relying solely on pre-authentication checks is no longer enough. The new frontier for defense is post-authentication monitoring and response. This means instrumenting systems to detect anomalies that might indicate a hijacked session, such as logins from unusual geographic locations, changes in browser fingerprints, or impossible travel scenarios where a user appears to be in two places at once. It also underscores the need for continuous user education that goes beyond "don't click suspicious links," as these attacks are designed to look entirely legitimate. Organizations should also consider implementing stricter session duration policies and exploring advanced security measures like phishing-resistant MFA and browser isolation technologies that can prevent session token theft.

This campaign demonstrates the limitations of authentication-focused security. By targeting session tokens directly, attackers can bypass MFA and password-based defenses entirely. This forces security teams to shift focus from login events to monitoring for anomalous in-session activity, a much harder detection problem.

A successful session hijacking gives an attacker full access to a corporate Google Workspace account, including email, documents, and cloud storage. This creates a severe risk of data breaches, intellectual property theft, and financial fraud. The reputational damage and cleanup costs from such a compromise can be substantial.