CERT Polska has issued a warning about a new wave of phishing attacks targeting Gmail users. The campaign is being carried out by the UNC1151 group, also known as Ghostwriter, which experts have for years linked to Belarus. It is one of the most active groups conducting cyber operations against Polish users and institutions.
According to CERT Polska, since March 2026, the attackers have been sending out fake messages impersonating Google security alerts with great intensity. Previously, the group focused mainly on users of Onet, WP and Interia email services, but now its activities are increasingly targeting Gmail users.
The attack scheme is relatively simple but effective. The victim receives a message informing them of an alleged login attempt, a security breach or the need for urgent account verification. The senders use addresses resembling official communications, such as “monitoring.konta@gmail.com” or “serwis.pomoc.techniczna@gmail.com”. Upon clicking the link, the user is taken to a page that looks strikingly similar to the Google login page.
On the fake site, not only the email address and password are phished, but also the second factor of authentication. This means that criminals can intercept both SMS codes and codes generated by authentication apps. According to experts, this type of attack allows for almost immediate account takeover. Similar techniques have also been observed in other campaigns attributed to UNC1151.
The compromised accounts are then searched for contacts, documents and information enabling access to further services, including social media accounts. The group’s targets include politicians, civil servants, journalists, academics and socially active individuals, though malicious messages may also reach random users.
Experts remind us that Google does not send security alerts from private addresses within the gmail.com domain. It is therefore crucial to check the sender, verify the login page address and exercise caution with messages that create a sense of urgency. Additional protection is provided by hardware security keys, which are resistant to code interception during such attacks.
