**Google Users Hit by Sophisticated Session Hijacking Campaign**
A complex and highly targeted cyber attack campaign has been uncovered, exploiting a vulnerability in Google’s session management system to hijack users’ accounts. The attackers are using clever tactics to obtain valid calendar invites, which they then use as live proxies to gain unauthorized access to sensitive information. This brazen campaign is a stark reminder of the ongoing cat-and-mouse game between hackers and security experts.
The attack starts with the attacker sending an email that appears to be from a trusted source, such as a colleague or business partner. The email contains a calendar invite that seems innocuous at first glance. However, upon closer inspection, it becomes clear that this is no ordinary invite. When the recipient clicks on the link and accepts the invitation, they inadvertently grant the attacker permission to act on their behalf in Google’s system.
The attackers then use this newly gained access to create a live proxy connection between their own account and the compromised user’s account. This allows them to gain real-time access to sensitive information, such as emails, documents, and even passwords stored in Google’s secure vaults. Once inside, they can map out cross-domain privilege escalation routes, creating backdoors that give them permanent access to the victim’s account.
The campaign has been successful because it exploits a fundamental weakness in Google’s session management system: the reliance on calendar invites as a form of authentication. By using this vulnerability, the attackers have managed to bypass the usual security measures and obtain access to sensitive information without being detected. It’s estimated that dozens of users have already fallen victim to this campaign.
What makes this attack particularly concerning is its sophistication and targeted nature. The attackers appear to be highly skilled and well-funded, suggesting that they may be backed by a nation-state or organized crime group. The fact that they’re using live proxies to gain access to sensitive information also suggests that their ultimate goal is not financial gain, but rather espionage or data theft.
So what can users do to protect themselves from this type of attack? First and foremost, it’s essential to be extremely cautious when receiving unsolicited calendar invites or emails. Never accept invitations from unknown sources, and always verify the authenticity of the sender before granting them access to your account. Additionally, make sure to regularly review your Google settings and permissions to ensure that you’re not inadvertently allowing unauthorized access to sensitive information.
In conclusion, this session hijacking campaign serves as a stark reminder that even with robust security measures in place, there’s always room for improvement. By staying vigilant and informed about the latest threats, we can all do our part to protect ourselves and our organizations from these types of attacks.
Source: The Hacker News — 2026-11-12