# UNC1151 targets Polish Gmail users with 2FA-capable phishing

Published: 2026-06-12 · Severity: high · Sectors: government-national, media, education
Canonical: https://vorant.io/reports/a4a6a559-bc20-4753-b274-3b65cc6427b7/unc1151-targets-polish-gmail-users-with-2fa-capable-phishing

> UNC1151/Ghostwriter is conducting high-intensity phishing campaigns against Polish Gmail users since March 2026, now capable of stealing two-factor authentication codes.

The UNC1151/Ghostwriter APT group has expanded its long-running credential harvesting operations against Polish targets to focus on Gmail users since March 2026. CERT Polska reports the campaigns run with high intensity on weekdays, using phishing emails that convincingly impersonate Gmail administrator communications. The group targets a broad range of individuals including political figures, public officials, researchers, journalists, law enforcement personnel, and their associates, as well as specific professional groups like translators and court experts.

A significant evolution in the group's capabilities is the ability to harvest two-factor authentication codes in real-time. After victims enter credentials on fake login pages, attackers automatically attempt to access the account; if 2FA is required, the phishing site displays an additional form to capture SMS codes or authenticator app tokens. The group uses dynamically changing infrastructure including newly registered domains (often .icu, .digital, .top TLDs), subdomains on platforms like Netlify, and compromised Polish websites to host phishing panels.

The phishing messages are written in fluent Polish without obvious errors, typically claiming suspicious activity or policy violations and threatening account suspension. Attackers frequently use BCC to distribute messages and often re-target the same victims multiple times within days, sometimes sending nearly identical messages with varying urgency. While UNC1151 has reduced the intensity of campaigns against Polish email providers like Onet and Interia, those operations continue alongside the Gmail-focused activity.

## Mentioned in this report

- Threat actors: UNC1151

## Detection guidance (public sample)

### DNS Query to Newly Registered Suspicious TLD Mimicking Google/Gmail Branding

ATT&CK: T1583.001

Detects DNS resolution of domains combining Google/Gmail-themed keywords with high-abuse TLDs (.icu/.digital/.top) frequently used by UNC1151 to stand up short-lived Gmail phishing panels. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: DNS Query to Newly Registered Suspicious TLD Mimicking Google Branding
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|contains:
    - google
    - gmail
    - account
    - accounts
    QueryName|endswith:
    - .icu
    - .digital
    - .top
  filter:
    QueryName|contains:
    - google.com
    - googleapis.com
    - gstatic.com
    - accounts.google.com
  condition: selection and not filter
fields:
- QueryName
- ClientIP
falsepositives:
- Legitimate third-party services or marketing tools that happen to use these TLDs
  and keywords together
- Internal DNS resolvers proxying benign lookups for security research/threat intel
  feeds
level: medium
tags:
- attack.t1583.001
- attack.reconnaissance
id: d87f04f9-5fa9-5a2f-b5fb-d595bb916aa9
status: experimental
author: Vorant
```

### HTTP Request to Netlify-Hosted Path Mimicking Google Account Login Flow

ATT&CK: T1566.002

Detects outbound web requests to *.netlify.app / *.netlify.com subdomains with URI paths mimicking Google account verification or 2FA challenge pages, consistent with UNC1151 phishing kits proxying real-time credential and MFA capture. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: HTTP Request to Netlify Subdomain With Google-Style Account Verification Path
logsource:
  category: proxy
  product: windows
detection:
  selection:
    c-uri|contains: netlify
    c-uri|re: (?i)(accounts?|signin|login|verify|2step|2fa|security).*
  filter:
    c-uri|contains:
    - netlify.com/docs
    - app.netlify.com/sites
  condition: selection and not filter
fields:
- c-uri
- src_ip
- user
falsepositives:
- Legitimate applications or demo sites hosted on Netlify that use similar authentication-themed
  URL paths
- Developers accessing Netlify dashboard/build pages containing 'login' or 'account'
  in the path
level: medium
tags:
- attack.t1566.002
- attack.initial_access
id: 65109ea9-96ef-58c7-ab86-8d1623ac2368
status: experimental
author: Vorant
```

### Suspicious Automated Re-Authentication Attempt Following Credential Submission on Non-Google Host

ATT&CK: T1556.006

Detects a client host resolving/connecting to a suspected phishing domain immediately followed by an outbound connection to Google account authentication endpoints from the same short-lived session, consistent with UNC1151's real-time relay of stolen credentials and MFA codes to victim accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound Connection to Google Auth Endpoint Immediately Following Suspicious
  Phishing Domain Access
logsource:
  category: network_connection
  product: windows
detection:
  selection_phish:
    DestinationHostname|endswith:
    - .icu
    - .digital
    - .top
    DestinationHostname|contains:
    - google
    - gmail
    - account
  selection_google_auth:
    DestinationHostname|contains:
    - accounts.google.com
    - myaccount.google.com
  condition: selection_phish or selection_google_auth
fields:
- DestinationHostname
- SourceIp
- Image
falsepositives:
- Normal user browsing sequences where a user legitimately visits a lookalike-named
  benign site before logging into Google
- Security scanners or threat-intel crawlers validating phishing domains followed
  by unrelated Google traffic from the same egress IP
level: low
tags:
- attack.t1556.006
- attack.credential_access
id: 83c4ab3f-8775-5e90-9a31-c49aa90fedd8
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/UNC1151-gmail-campaign/

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a4a6a559-bc20-4753-b274-3b65cc6427b7/unc1151-targets-polish-gmail-users-with-2fa-capable-phishing.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup