CERT Polska warns of Ghostwriter Gmail phishing aimed at elites

POLAND'S national cyber team, CERT Polska, warns of an active phishing campaign by the group UNC1151 (also known as Ghostwriter) targeting Gmail accounts, particularly high-profile users, since March 2026. This Belarus-linked group aims to steal credentials, contacts, and documents, often impersonating Google in their emails to lure victims into entering their information on fake login pages. The scammers utilize aggressive tactics, sending multiple emails and changing their phishing domains frequently. Defenses against such attacks include not clicking email links for login and using strong authentication methods.