Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign

Google's session hijacking campaign, detailed by The Hacker News, reveals that attackers have been stealing live Google sessions from corporate users via malicious calendar invites and live proxies since mid‑August 2026, bypassing typical link‑reputation checks. For website owners, this means that any site integrated with Google authentication—whether for single sign‑on, analytics, or ad‑tech—faces a heightened risk of unauthorized access through compromised Google accounts. Bots masquerading as legitimate users can now harvest session cookies and interact with your site, inflating traffic metrics, scraping proprietary content, or performing credential‑stuffing attacks. Moreover, the clean‑looking links used in calendar invites can bypass standard URL‑filtering tools, making it harder to detect malicious referrals in your logs. **Actionable tips:** 1. **Update your llms.txt** to explicitly disallow crawling from any Google‑derived user‑agent strings or IP ranges associated with known live proxy services, and list “Google‑Session‑Hijack” as a prohibited bot. 2. Deploy a real‑time session‑validation layer that cross‑checks OAuth tokens against Google’s token‑introspection endpoint, rejecting requests with tokens issued from suspicious IPs or with anomalous usage patterns. 3. Leverage llmscentral’s bot‑tracking dashboard to flag sudden spikes in traffic from Google‑related referrers and set up automated alerts for any deviation from baseline user behavior.