Since mid-August, a phishing operation has been stealing live Google sessions from corporate users, per BleepingComputer, reporting on research by Material Security. The lures arrived as Google Calendar invites, often from an organization the victim had already emailed with. The pretexts were boring on purpose: voicemail notices, RFP requests, court summonses, missed payments.

How it beat MFA. The links mostly pointed at Google's own redirector, Google Drive or share.google, so every reputation check came back clean. Behind them sat a live relay in front of the real Google sign-in page. Victims typed their password, got a real prompt, approved it, and the attacker passed every code to Google in real time: text codes, authenticator codes, number matching, even phone-based recovery. The attacker walked away with the signed-in session, which reaches mail, Drive, and the power to grant app access in the victim's name. Material counted 8,570 hacked sender addresses across 6,354 domains in one month, and says the operator has an unused Microsoft 365 version ready to go.

Why small businesses should care. Your team trusts invites from customers and vendors. In this campaign, those were exactly the accounts sending the bait. And MFA codes and push prompts, the protection most small offices rely on, didn't stop it.

Action item: Close the gap MFA left open.
1. Move key accounts to passkeys or security keys. Start with owners, whoever pays bills, and whoever runs IT. A passkey won't sign in to a lookalike page, so it can't be relayed.
2. Tell staff the rule: a sign-in prompt you didn't expect gets a "no," and a sign-in page reached from an invite link gets closed. Go to the site directly instead.
3. Limit who can drop events on your calendar. In Google Calendar on a computer: Settings, Event settings, "Add invitations to my calendar," then "Only if the sender is known."
4. Know how to kill a session. If someone thinks they signed in through a strange link, sign them out everywhere, reset the password, and check which apps have access. Practice doing it in under an hour.

Want help switching your office to passkeys? Call us at +1 (689) 225-0286, or start with the free security checklist.

Second item: mSecure users, reset your passwords. mSeven Software told current and former mSecure customers on Nov 3 to change passwords, reset two-factor, and remove passkeys stored in the app, per BleepingComputer. Support replies shared by customers say a hacker stole an encrypted database from mSecure Cloud, affecting users who synced through it. The company says it has no evidence the encrypted contents were accessed. But a stolen vault can be attacked offline for as long as the attacker likes, and a new master password doesn't change the copy they already have.

• If you synced mSecure to its cloud, change your most important passwords first: email, bank, payroll, and your domain registrar.
• Then reset two-factor on those accounts, and replace any passkeys stored in mSecure.