Ghostwriter (UNC1151) has escalated its long-standing phishing operations by deploying convincing fake Gmail login panels that harvest both passwords and two-factor authentication (2FA) codes, CERT Polska reports.
The group historically focused on Polish email providers such as Onet, Wirtualna Polska and Interia shifted in March 2026 to high-volume Gmail-targeted campaigns.
Attackers send professionally worded Polish-language emails that allege suspicious activity or imminent account suspension and lure recipients to counterfeit login pages hosted on a rotating set of domains and abused hosting services.
The phishing messages are frequently delivered from newly created Gmail accounts or, less commonly, from compromised mailboxes whose display names are altered to appear legitimate.
To widen reach and reduce detection, UNC1151 often uses BCC so large batches of recipients see the same message without visible recipient lists. Language quality is generally high, removing an easy giveaway for less observant targets.
Links in the emails resolve to pages that visually mimic Gmail’s sign-in interface while using incorrect domains a primary indicator of fraud.
A notable technical advance in these campaigns is explicit harvesting of second-factor codes. After victims enter email and password, the fake panel either attempts an automated login or prompts immediately for a one-time code.
This second prompt captures SMS-delivered codes and app-generated codes (for example, from Google Authenticator), enabling attackers to bypass two-step protections that would have previously blocked straightforward credential theft.
According to CERT Polska,the adversary repeatedly targeting the same inboxes, sometimes sending multiple follow-ups within days to increase urgency and likelihood of interaction.
UNC1151 operates with a flexible infrastructure designed for rapid domain churn. The group uses a mix of dedicated phishing domains (commonly under TLDs like .icu, .digital, and .top), subdomains created on permissive hosting platforms (notably *.netlify.app), and occasionally compromised legitimate websites particularly small Polish organizations whose sites were likely exploited without altering the visible main page to avoid detection.
Examples of domains used in recent campaigns include mailverify.digital, verify-check.digital, and monitoring-google-konta.netlify.app. These short-lived assets are swapped frequently; CERT Polska observed new phishing domains appearing almost daily during active phases.
Target selection remains broad and strategic. UNC1151 focuses on political actors, public officials, journalists, researchers, law-enforcement personnel, and associates connected through family or professional ties.
In some cases attackers guess addresses based on common names, producing collateral phishing hits against unrelated individuals.
Campaigns also tailored by profession or locale for example, translators or court experts in particular regions. Messages often emphasize an imminent suspension window or “critical” alert to coerce rapid responses.
Detection and mitigation hinge on awareness and multi-layered defenses. Key user-level signs include mismatched domains in the browser address bar, unexpected requests for 2FA codes immediately after entering credentials, and messages urging immediate action without prior context.
Organizations should enforce phishing-resistant authentication such as hardware security keys, monitor for credential stuffing and anomalous logins, and adopt domain monitoring and takedown workflows for lookalike domains.
CERT Polska’s analysis includes sample senders and messages and demonstrates the group’s persistence: even if a user does not interact, repeated emails increase the likelihood of eventual compromise.
Security teams should treat this campaign as an urgent reminder that 2FA via SMS or app codes can be phished and that strong, phishing-resistant controls are now essential.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…