Belarus-Linked UNC1151 Launches Gmail Phishing Campaign to Steal 2FA Codes

CERT Polska reports that UNC1151 (Ghostwriter), a Belarus-linked APT, has shifted from targeting Polish webmail providers to a high-volume Gmail phishing campaign that actively harvests passwords and two-factor authentication codes via convincing fake Gmail login pages, deceptive domains (e.g., .digital, .icu, Netlify subdomains) and compromised sites, targeting politicians, officials, journalists, researchers and their contacts.