Material Security says it took down 897 phishing domains
Cloudflare placed warnings before the reported destinations after the security company’s researchers flagged them through its abuse system.
Loading… Բեռնվում է…
Cloudflare placed warnings before the reported destinations after the security company’s researchers flagged them through its abuse system.
Material Security says it took down 897 unique domains during one month of Operation CloudFire, an effort to disrupt a campaign that used calendar invitations to steal corporate Google sessions. Its researchers sent gateway and backend web addresses to Cloudflare, which checked the destinations and placed phishing warnings before them.
The campaign had been stealing live sessions since mid-August 2026, Material Security said in its CloudFire update. By the end of September, the company had decided to target the infrastructure because detecting messages did not stop the operator from preparing another wave.
The messages used Google Calendar invitations sent from accounts the attacker had already compromised. Those accounts contacted saved addresses and other targets, so recipients could see a familiar sender or a recognizable domain with a clean history, Material Security said.
The campaign used a live proxy—a service that passes information between a user and another site—in front of the real Google sign-in page to capture sessions. Material Security said the lure domains appeared clean in every commercial reputation feed it checked, while the capture page only existed after a browser built it. Checks based on ownership and past activity therefore returned reassuring results.
The company said people following reported links encountered a warning instead of a credential-capture form. It said the operator would have to re-register, redirect and obtain new certificates for the reported gateways and receiving endpoints before sending again.
Material Security’s figures cover one month and use data from customers that agreed to share it. The compromised addresses were sender accounts already controlled before invitations went out, not a count of newly compromised recipients. The company did not give a total number of victims or precise takedown dates.
| Measure | Count |
|---|---|
| Campaign messages blocked | 68,676 |
| Unique malicious URLs analyzed | 2,112 |
| Unique compromised sender addresses | 8,570 |
| Root domains represented by those addresses | 6,354 |
Analysis
Material Security said the lures shifted from calendar invitations to Google file and document-sharing invitations, without a corresponding increase in other themes or tactics. It said the group’s activity appears to have dispersed and the campaign seemingly ended.
The company cautioned that the infrastructure is cheap to rebuild. It said the framework, Nyasher, had been public since February and that the operator included an unfinished Microsoft 365 branch alongside the live Google code. Material Security sees the September theme changes as a sign that the operator was continuing to iterate, not retiring. If another pivot comes, Material Security expects it to resemble this campaign with a different brand.
The model is available for noncommercial research and, DeepMind says, predicts DNA effects for a specified tissue, cell type or cell state.
2 min
The international center is targeted to open in summer 2027. The ministry hopes for NATO recognition and will present its plans to representatives of other countries.
1 min
Ukraine’s president says the restrictions have lasted several days and left interceptors too slow to stop some Russian drones, allowing strikes through and helping Russian forces kill more Ukrainians.
2 min