Since March 2026, the UNC1151/Ghostwriter threat actor has been running high-intensity phishing campaigns targeting Gmail accounts of Polish citizens, especially those in sensitive or prominent roles. The attackers impersonate Gmail administrators in emails to pressure victims into account verification, capturing credentials and 2FA codes through fake login pages hosted on various domains and compromised sites. The campaign demonstrates a sustained operational tempo with frequent domain changes and weekday activity. This phishing effort aims to bypass two-factor authentication and steal credentials, leveraging social engineering and infrastructure diversity to evade detection.

The campaign enables credential theft including two-factor authentication codes, potentially allowing attackers to gain unauthorized access to targeted Gmail accounts. This compromises the confidentiality and integrity of email communications for high-profile Polish individuals in political, public, research, journalistic, administrative, and law enforcement sectors. The persistent and targeted nature of the campaign increases the risk of successful account compromise and subsequent misuse of sensitive information.

No official patch or fix applies as this is a phishing campaign. Defenders should educate targeted users about phishing tactics, especially emails impersonating Gmail administrators requesting account verification. Users should verify URLs before entering credentials and use additional security measures such as hardware security keys where possible. Monitoring and blocking the identified phishing domains (mailverify.digital, check-mail-verify.biz, verify-check.digital) and related infrastructure can help reduce exposure. Since this is a social engineering attack, user awareness and cautious handling of suspicious emails are critical.