{"id":"ghostwriter-gmail-phishing-2fa-jun-2026","category":"scam","status":"closed","title":"Ghostwriter (UNC1151) phishes Gmail users with fake security alerts to steal passwords and 2FA codes","tldr":"Belarus-linked Ghostwriter has sent fake Gmail admin alerts since March 2026 to steal passwords and 2FA codes from prominent Poles and their families. Never sign in from an email link. Use a passkey or security key, and check the address bar.","summary":"CERT Polska reported on 12 June 2026 that the Belarus-linked group UNC1151, also known as Ghostwriter, has run phishing campaigns against Gmail users since March 2026. Earlier it mostly targeted Polish email providers such as Onet, Wirtualna Polska and Interia. The emails, written in Polish, pose as Gmail administrator notices about suspicious logins or policy breaches and threaten suspension or deletion. Links lead to fake Gmail sign-in pages that capture the password and then ask for the two-factor code, whether sent by SMS or generated by an authenticator app. Targets include politicians and public figures, journalists, researchers, public administration and law enforcement staff, and their family and social contacts. Messages are repeated, sometimes several times within two days, with shrinking deadlines. CERT Polska did not say how many accounts were compromised. There is no software flaw and nothing to patch. CERT-EU repeated the report in its June 2026 brief. We found no later reporting of arrests, takedowns or victim numbers.","action":"Never sign in to Gmail from a link in an email. Type the address or use a bookmark, and check the domain in the address bar. Where you can, switch to passkeys or a security key, because fake pages can capture SMS and app codes.","product":"Google Gmail accounts (targeted by phishing, not a software flaw)","audience":"both","severity":"medium","patch":"na","exploited":true,"cves":[],"tags":["ghostwriter","unc1151","gmail","phishing","2fa","belarus","poland","scam"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"UNC1151 phishing campaigns targeting Gmail users","url":"https://cert.pl/en/posts/2026/06/UNC1151-gmail-campaign/","by":"CERT Polska","date":"2026-06-12"},{"kind":"research","title":"CERT-EU Cyber Brief 26-07 (June 2026)","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-07/","by":"CERT-EU","date":"2026-07-01"}],"started":"2026-06-12","closed":"2026-07-01","created":"2026-11-03T21:32:32.983Z","updated":"2026-11-03T21:32:32.983Z","cve_notes":[],"timeline":[{"at":"2026-07-01","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"CERT-EU's June 2026 threat brief listed the campaign among the month's cyber-espionage activity, describing phishing of Gmail users in Poland with fake security alerts to steal credentials and 2FA codes. It reported no new victim numbers, arrests or takedowns.","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-07/","by":"CERT-EU","patch":"na"},{"at":"2026-06-12","added":"2026-11-03T21:28:26.316Z","kind":"disclosed","text":"CERT Polska published its findings on a Gmail phishing campaign by the Belarus-linked group UNC1151 (Ghostwriter). It says the group has targeted Gmail users since March 2026, using fake Gmail administrator notices to steal passwords and two-factor codes. Targets include politicians, journalists, researchers, public officials and their family and social contacts. The number of victims was not stated.","url":"https://cert.pl/en/posts/2026/06/UNC1151-gmail-campaign/","by":"CERT Polska","patch":"na"}],"url":"https://hard.fyi/live/ghostwriter-gmail-phishing-2fa-jun-2026/","json":"https://hard.fyi/api/live?id=ghostwriter-gmail-phishing-2fa-jun-2026"}