UNC1151 targets Polish Gmail users with 2FA-capable phishing
UNC1151/Ghostwriter is conducting high-intensity phishing campaigns against Polish Gmail users since March 2026, now capable of stealing two-factor authentication codes.
Sourcecert.pl — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The UNC1151/Ghostwriter APT group has expanded its long-running credential harvesting operations against Polish targets to focus on Gmail users since March 2026. CERT Polska reports the campaigns run with high intensity on weekdays, using phishing emails that convincingly impersonate Gmail administrator communications. The group targets a broad range of individuals including political figures, public officials, researchers, journalists, law enforcement personnel, and their associates, as well as specific professional groups like translators and court experts.
A significant evolution in the group's capabilities is the ability to harvest two-factor authentication codes in real-time. After victims enter credentials on fake login pages, attackers automatically attempt to access the account; if 2FA is required, the phishing site displays an additional form to capture SMS codes or authenticator app tokens. The group uses dynamically changing infrastructure including newly registered domains (often .icu, .digital, .top TLDs), subdomains on platforms like Netlify, and compromised Polish websites to host phishing panels.
The phishing messages are written in fluent Polish without obvious errors, typically claiming suspicious activity or policy violations and threatening account suspension. Attackers frequently use BCC to distribute messages and often re-target the same victims multiple times within days, sometimes sending nearly identical messages with varying urgency. While UNC1151 has reduced the intensity of campaigns against Polish email providers like Onet and Interia, those operations continue alongside the Gmail-focused activity.
Mentioned in this report
Detection guidance
DNS Query to Newly Registered Suspicious TLD Mimicking Google/Gmail Branding
A behavioural hunt for the technique in general.
Detects DNS resolution of domains combining Google/Gmail-themed keywords with high-abuse TLDs (.icu/.digital/.top) frequently used by UNC1151 to stand up short-lived Gmail phishing panels. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DNS Query to Newly Registered Suspicious TLD Mimicking Google Branding
logsource:
category: dns_query
product: windows
detection:
selection:
QueryName|contains:
- google
- gmail
- account
- accounts
QueryName|endswith:
- .icu
- .digital
- .top
filter:
QueryName|contains:
- google.com
- googleapis.com
- gstatic.com
- accounts.google.com
condition: selection and not filter
fields:
- QueryName
- ClientIP
falsepositives:
- Legitimate third-party services or marketing tools that happen to use these TLDs
and keywords together
- Internal DNS resolvers proxying benign lookups for security research/threat intel
feeds
level: medium
tags:
- attack.t1583.001
- attack.reconnaissance
id: d87f04f9-5fa9-5a2f-b5fb-d595bb916aa9
status: experimental
author: Vorant
HTTP Request to Netlify-Hosted Path Mimicking Google Account Login Flow
A behavioural hunt for the technique in general.
Detects outbound web requests to *.netlify.app / *.netlify.com subdomains with URI paths mimicking Google account verification or 2FA challenge pages, consistent with UNC1151 phishing kits proxying real-time credential and MFA capture. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP Request to Netlify Subdomain With Google-Style Account Verification Path
logsource:
category: proxy
detection:
selection:
c-uri|contains: netlify
c-uri|re: (?i)(accounts?|signin|login|verify|2step|2fa|security).*
filter:
c-uri|contains:
- netlify.com/docs
- app.netlify.com/sites
condition: selection and not filter
fields:
- c-uri
- src_ip
- user
falsepositives:
- Legitimate applications or demo sites hosted on Netlify that use similar authentication-themed
URL paths
- Developers accessing Netlify dashboard/build pages containing 'login' or 'account'
in the path
level: medium
tags:
- attack.t1566.002
- attack.initial-access
id: 65109ea9-96ef-58c7-ab86-8d1623ac2368
status: experimental
author: Vorant
Suspicious Automated Re-Authentication Attempt Following Credential Submission on Non-Google Host
A behavioural hunt for the technique in general.
Detects a client host resolving/connecting to a suspected phishing domain immediately followed by an outbound connection to Google account authentication endpoints from the same short-lived session, consistent with UNC1151's real-time relay of stolen credentials and MFA codes to victim accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Connection to Google Auth Endpoint Immediately Following Suspicious
Phishing Domain Access
logsource:
category: network_connection
product: windows
detection:
selection_phish:
DestinationHostname|endswith:
- .icu
- .digital
- .top
DestinationHostname|contains:
- google
- gmail
- account
selection_google_auth:
DestinationHostname|contains:
- accounts.google.com
- myaccount.google.com
condition: selection_phish or selection_google_auth
fields:
- DestinationHostname
- SourceIp
- Image
falsepositives:
- Normal user browsing sequences where a user legitimately visits a lookalike-named
benign site before logging into Google
- Security scanners or threat-intel crawlers validating phishing domains followed
by unrelated Google traffic from the same egress IP
level: low
tags:
- attack.t1556.006
- attack.credential-access
id: 83c4ab3f-8775-5e90-9a31-c49aa90fedd8
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/UNC1151-gmail-campaign/
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs