# UNC1151 shifts Ghostwriter phishing to Gmail with 2FA theft

Published: 2026-06-12 · Severity: high · Sectors: government-national, media, education
Canonical: https://vorant.io/reports/5d3d7383-a5d5-5619-8780-e66dc2343008/unc1151-shifts-ghostwriter-phishing-to-gmail-with-2fa-theft

> UNC1151/Ghostwriter is running an intensive Polish-language phishing campaign against Gmail users since March 2026 that can steal both passwords and 2FA codes.

CERT Polska reports that UNC1151 (Ghostwriter), a long-running APT group targeting Polish citizens, has pivoted from its traditional focus on domestic webmail providers (Onet, Wirtualna Polska, Interia) to large-scale phishing against Gmail accounts. Since March 2026 the group has run near-daily campaigns using freshly registered domains (often on .icu, .digital, .top TLDs) and abuse of free hosting platforms such as netlify.app, alongside compromised legitimate Polish websites used to host fake login panels without altering the site's homepage to avoid detection.

The phishing emails impersonate official Gmail account-security notices, are written in fluent Polish, and pressure recipients with threats of account suspension. Messages are frequently sent via BCC or from throwaway/compromised Gmail accounts, sometimes repeated in rapid succession against the same target to increase pressure. The most significant technical development is the addition of real-time two-factor authentication interception: after harvesting credentials, the phishing kit automatically attempts login and dynamically presents a form to capture SMS or authenticator-app codes, defeating standard 2FA protections.

Targeting remains broad but deliberate, focused on individuals in political and public life, government and law enforcement personnel, journalists, researchers, and niche professional groups such as translators and court experts, as well as their social and family contacts. CERT Polska notes that while intensity against Polish webmail providers has decreased, UNC1151 has not abandoned those campaigns, indicating parallel, adaptive operations rather than a full pivot.

## Mentioned in this report

- Threat actors: UNC1151

## Detection guidance (public sample)

### Gmail-Themed Phishing Page Hosted on Free Hosting Platform (Netlify)

ATT&CK: T1584.006

Detects web requests to netlify.app-hosted pages whose URL path mimics Google account/security verification flows, consistent with UNC1151 abusing free hosting for fake Gmail login panels. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Gmail-Themed Phishing Page Hosted on Free Hosting Platform
id: d8b81a91-53cb-567b-8305-15682555d269
status: experimental
description: Detects HTTP requests to netlify.app subdomains whose path mimics Google
  account security or sign-in flows, matching UNC1151's technique of hosting fake
  Gmail login panels on abused free hosting platforms.
references:
- CERT Polska UNC1151/Ghostwriter Gmail phishing report
logsource:
  category: proxy
  product: any
detection:
  selection:
    DestinationHostname|contains: netlify.app
    c-uri|contains:
    - accounts.google
    - myaccount.google
    - security-alert
    - signin
    - verify-account
  condition: selection
falsepositives:
- Legitimate apps hosted on Netlify that implement Google OAuth sign-in flows
- Developer test/staging sites using Google-branded UI templates
level: high
tags:
- attack.t1584.006
- attack.t1566.002
author: Vorant
```

### Gmail Account-Security Phishing Domain on Rare TLD

ATT&CK: T1583.001

Detects DNS queries for newly registered-style domains on rare TLDs (.icu/.digital/.top) whose name contains Gmail/Google/account/security keywords, matching UNC1151's domain registration pattern for Gmail phishing campaigns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Gmail Account-Security Phishing Domain on Rare TLD
id: 1a0d5fb5-9460-5f95-934b-5ceaa77ae2ed
status: experimental
description: Detects DNS resolution of domains on rare TLDs (.icu, .digital, .top)
  combined with Gmail/Google/account-security related keywords, consistent with UNC1151's
  near-daily registration of fresh phishing domains impersonating Google account-security
  notices.
references:
- CERT Polska UNC1151/Ghostwriter Gmail phishing report
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|endswith:
    - .icu
    - .digital
    - .top
    QueryName|contains:
    - gmail
    - google
    - account
    - security
  condition: selection
falsepositives:
- Legitimate services on these TLDs offering account or security-related products
- Security awareness training platforms using similar naming
level: medium
tags:
- attack.t1583.001
- attack.t1584.001
author: Vorant
```

### Real-Time OTP/2FA Code Submission to Non-Google Domain

ATT&CK: T1111

Detects HTTP requests submitting OTP/verification-code parameters to a domain that is not a legitimate Google domain, matching the phishing kit behaviour of dynamically prompting for and relaying SMS/authenticator codes to defeat 2FA. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Real-Time OTP or 2FA Code Submission to Non-Google Domain
id: 303866fe-f187-553b-bd12-0dfb746cce37
status: experimental
description: Detects web requests containing OTP/2FA/verification-code parameters
  or paths sent to a destination host that is not a legitimate Google domain, consistent
  with UNC1151's phishing kit that automatically logs in with stolen credentials and
  dynamically presents a form to capture SMS or authenticator app codes.
references:
- CERT Polska UNC1151/Ghostwriter Gmail phishing report
logsource:
  category: proxy
  product: any
detection:
  selection:
    c-uri|contains:
    - otp
    - verification-code
    - 2fa
    - 2step
    - authcode
    - challenge/ipp
  filter:
    DestinationHostname|contains:
    - google.com
    - gstatic.com
    - googleusercontent.com
    - googleapis.com
  condition: selection and not filter
falsepositives:
- Legitimate third-party MFA services using similar URL keywords for their own OTP
  flows
level: high
tags:
- attack.t1111
- attack.t1566.002
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/UNC1151-gmail-campaign

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5d3d7383-a5d5-5619-8780-e66dc2343008/unc1151-shifts-ghostwriter-phishing-to-gmail-with-2fa-theft.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup