- Published
- Source
- The Hacker News
- Filed under
- Identity
- Technique
- T1566 Phishing (opens in a new tab)
Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a link came back clean, and the operator designed it that way on purpose. The Threat Research team at Material Security spotted the campaign and has since taken down hundreds of attacker domains in an effort the team calls Operation CloudFire.
Protecting sign-ins
- Phishing-resistant multi-factor authentication – passkeys or security keys – for administrators first.
- Block the old sign-in methods that skip MFA, and review who can grant apps access to your data.
- Alert on impossible travel, newly added MFA methods and unusual consent grants.
More helpNCSC: multi-factor authentication for online services (opens in a new tab)
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Phishing
Initial AccessWhat a defender checks
- Search mail flow for the sender, subject and links, and pull every copy from mailboxes.
- Check who clicked or replied, and what signed in afterwards.
- Block the sender and URLs, and tell staff what to look for.
Build the skillBlue Team Analyst, Email & Phishing Investigation
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Engineer
Build the controls that stop the next one.
Blue Team Engineer: 28 live classes configuring identity, endpoint, email, network and cloud security in your own Azure and Microsoft Defender tenants – then evidencing it against CIS and NIST CSF, and defending every decision. For people with IT, cloud or SOC experience.
- Conditional Access, PIM and tiered admin
- CSPM, Azure Policy and a landing zone
- Detection engineering and SOAR playbooks
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.