In short
- A phishing email impersonating Google targeted an individual involved in the Belarusian democratic movement. It aimed to steal their Google password and two-factor authentication codes. The attempt failed: the recipient did not click the link.
- We attributed the attempt to UNC1151, a hacking group that Google links to the Belarusian government. The email looked different, but it used the same phishing setup we documented in May 2026.
- That is the “persistent” in APT: they keep coming back with new tricks, trying again and again until someone makes a mistake.
- SMS and authenticator app codes do not stop this kind of attack. Hardware security keys, such as YubiKeys, combined with Google’s Advanced Protection Program do.
Part 1 — What happened, in plain language
The email
In mid-September 2026, a person active in the Belarusian democratic movement received a Russian-language email impersonating Google. It claimed that a “malfunction” had been detected in their account and that access would be “restricted”. A link offered “the full details”. The recipient suspected phishing, did not click the link, and forwarded the email to us. We found no evidence of account compromise.
The sender impersonated Google using a free Gmail account with the display name “Account Support”. Because the message was sent through Gmail, it passed standard email authentication checks and reached the recipient’s inbox.
Figure 1. Phishing email impersonating Google Account Support, sent from [email protected]. Subject [translated from Russian]: “Notifications.” Email text [translated from Russian]: “Hello! A malfunction has been detected in your account. The account will be subject to restrictions. To restore your account, please review the full details. Sincerely, Support Service.” Footer: “We sent this email to your address to inform you of updates regarding your account. © 2026 Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.”
What would have happened after a click
- A hacked website. The link would first have taken the recipient to the website of a small mountain hostel in Poland. Attackers had compromised the site and planted files that redirected visitors. Using a legitimate, long-established website made the link look more credible and could help it evade security filters. The site owner was also a victim.
- A fake warning page. The next page mimics a Google notice: “Your account will be blocked and deleted within 24 hours. You can file an appeal to prevent deletion.” Hovering over the “File an appeal” button shows a genuine Google address in the browser. Clicking it, however, takes the visitor elsewhere. This trick defeats the familiar advice to hover over a link to check its destination.
- A fake Google sign-in page. This is a near-identical copy of the real Google sign-in page.
Figure 2. Fake Google account restriction and appeal page displayed by the attackers. Text translated from Russian: “Information about restricted access to the service. Access to this service or feature is restricted. If you believe an error has occurred, submit an appeal. Gmail. It appears that the Gmail service was used to distribute malicious content, namely to steal confidential information or obtain it through deception. Such actions violate Google’s policies. Emails will no longer be delivered to your Google mailbox. Google services are restricted for your account. Your account will be blocked and deleted within 24 hours. You can submit an appeal to prevent deletion. Submit an appeal.”
Why this attack is so dangerous
The fake sign-in page does more than steal passwords. It sends the victim’s input to an attacker in real time. The attacker enters it on Google’s genuine sign-in page. The genuine Google then asks for the second authentication step, and the fake page is built to get past it:
- If Google asks for an SMS or authenticator app code, the fake page asks the victim to enter it and immediately relays it to the attacker.
- If Google sends a sign-in prompt to the victim’s phone, that prompt is genuine: it was triggered by the attacker’s sign-in attempt. The fake page tells the victim which number to select (“tap Yes, then tap 36”), leading them to approve the attacker’s sign-in.
Either way, the attacker could get access to the account within seconds. SMS codes, authenticator apps and Google phone prompts do not protect against this attack: a person on the other end defeats them in real time.
Once inside, an attacker could:
- access all emails, contacts and documents;
- Impersonate the victim in messages to their colleagues;
- take over other services that use this email address for password resets.
For someone active in the democratic movement, a compromise would expose not only one person but their wider network.
Figure 3: First fake Google sign-in page to which the target was redirected. “Verification. Stage 1: use the name of your Google account”
Who is behind it
We attribute this campaign to UNC1151 with high confidence. Other cybersecurity companies track this espionage group as FrostyNeighbor, Storm-0257, TA445 and UAC-0051. UNC1151 is closely linked to Ghostwriter, a long-running influence campaign. Google’s threat-intelligence team, Mandiant, assessed that UNC1151 likely provides technical support to Ghostwriter and has carried out some of its operations (Google/Mandiant).
Mandiant has linked UNC1151 to the Belarusian government with high confidence. It also assessed that the Ghostwriter campaign aligned with Belarusian government interests (Google/Mandiant). For years, UNC1151 has been stealing passwords and spying on targets in Ukraine, Poland, Lithuania, Latvia and Germany, as well as Belarusian democratic figures, civil society and journalists.
This is the same group, and the same phishing machinery, that we documented in our May 2026 report. This time the email had:
- a new sender;
- new wording;
- a new hacked website;
- new servers.
The engine underneath was the same: the fake sign-in page and the software running on the attackers’ servers. The group was also running a parallel campaign targeting Polish-speaking users with fake Google pages in Polish.
What an “APT” means, and why the “persistent” matters
Security researchers describe groups like UNC1151 as advanced persistent threats, or APTs.
- Advanced: they are well-funded and technically skilled, and they have time to prepare.
- Persistent: this is the key word. These are not lone scammers trying their luck. They are teams of people working for, or on behalf of, a government. They earn a salary, and their full-time job is to break into the accounts of the people their government considers targets. They come to work every morning and do it again.
- Threat: they have a specific goal: your account, your contacts, your information.
In practice, you might spot this phishing email today, and the next one too. But they will keep sending. In a few weeks or a few months the email will look different: a new sender, a new story, a new design, maybe a different language, maybe pretending to be a colleague instead of Google. This case shows exactly that. Between May and September 2026 the group changed almost everything a victim can see, and kept the same machinery underneath.
To stay safe by vigilance alone, you would have to recognize every one of their emails, every time, for years. They only need you to make one mistake once: on a busy day, on your phone, late at night.
That is why we believe that, for people who are targeted by state-backed groups, spotting phishing is not enough. The protection has to be technical. It has to keep working even on the day you do click.
How to protect yourself
The protection that defeats this attack: hardware security keys plus Google Advanced Protection.
- Get two hardware security keys (for example, YubiKeys) and enroll your Google account in Google’sAdvanced Protection Program.
- A security key checks cryptographically which website it is talking to. It will not work on a fake Google page, so even if you click the link and type your password, the attacker cannot sign in.
- Use one key every day and keep the second one somewhere safe as a backup.
- Advanced Protection also locks down account recovery and third-party app access, which attackers commonly abuse.
- Treat any “your account will be blocked or deleted” message as suspicious. Never use the link. Open the service by typing its address yourself.
- Don’t trust the sender’s name. “Account Support” can be written on any email. In this case, the real address was an ordinary @gmail.com account, not Google.
- If you entered anything on a page like this, act immediately from a different, trusted device:
- report to your IT/security team;
- change your Google password;
- go to your Google account’s settings, open “Your devices” → “Manage all devices” and choose “Sign out of all devices”;
- check mail forwarding, filters, delegated access, app passwords, third-party app access, and your recovery phone and email.
Bottom line. The email had no attachment and did not try to install malware on the recipient’s device. Its goal was to steal credentials and take over the account. A hardware security key breaks this attack even if the recipient is fooled into entering their password.
Part 2 — Technical brief (for analysts)
Email received: 14 September 2026 · Analyzed: 15 September 2026 · Last updated: 29 October 2026
Verdict: CRITICAL. This is real-time (“adversary-in-the-middle”) phishing designed to steal a Google password and get past the second sign-in step (SMS or app codes, or Google’s phone prompt). We attribute this campaign with high confidence to UNC1151, a Belarus-linked espionage group associated with the “Ghostwriter” campaign. Other security companies track it as FrostyNeighbor, Storm-0257, TA445 and UAC-0051.
Target: a person active in the Belarusian democratic movement who is involved in several pro-democracy and civil society organisations. (Identity and email address withheld.)
Outcome: the recipient recognized the email as suspicious, did not follow the link, and reported it to us. No account compromise was found.
The phishing kit, its WebSocket relay and its operator-in-the-loop workflow are described in detail in our May 2026 report and are not repeated here. This section covers what changed, the attribution, the wider activity, and the indicators.
The recipient did not click the link. The findings below come from our analysis of the email and the attackers’ infrastructure, rather than from a compromised account.
Public scan of the live phishing page (28 October 2026): https://urlscan.io/result/01a182f6-a49a-71cb-8bdb-f4154fdf7ba4/ We are grateful to urlscan.io, Censys and Google Threat Intelligence for providing tools and services that support investigations like this one into attacks on civil society.
Kill chain
What changed since May 2026
| May 2026 | September 2026 | |
|---|---|---|
| Sender | Real Gmail account; display name built from Cyrillic look-alike letters | Real Gmail account; plain “Account Support” |
| Lure | Long “suspicious activity / complaints” notice; deletion in 24 h | Short “account malfunction” notice, then a pretext page: “account will be deleted within 24 h — file an appeal” |
| Redirector | Compromised OpenCart e-shop (Ukraine) | Compromised website of a mountain hostel (Poland) |
| Landing | Attacker-registered domain behind a CDN | Free subdomain on InfinityFree hosting (gt.tc) |
| Relay channel | Attacker domain on free dynamic DNS, behind a CDN | Free ngrok tunnel |
| Operator backend | Server at Datagear LLP (Poland) | Different server at IPHOSTER OÜ (Germany), running the same backend software |
| Credential page | — | The same file as in May, with only the relay address changed |
Two points are new:
- Hover-safe redirect. The pretext page adds a button whose href is a genuine myaccount.google.com URL, while an onclick handler sends the victim to the kit. It is aimed squarely at “hover to check the link” advice.
- Victim-facing components are free or compromised. Everything a victim touches runs on free services or a compromised site: a Gmail account, a hacked website, free web hosting and an ngrok tunnel. No attacker-registered domain or CDN is involved. The operator backend is hosted separately at IPHOSTER OÜ; how that server was obtained is not established.
As in May 2026, the kit relays SMS and authenticator codes to the operator. For Google phone prompts, it displays the number supplied by the operator, so that the victim approves the attacker’s genuine sign-in on their own phone.
Attribution: UNC1151 (high confidence)
We assess with high confidence that this campaign was conducted by UNC1151, a Belarus-linked espionage cluster associated with Ghostwriter activity. Other vendors track the group as FrostyNeighbor (ESET), Storm-0257 (Microsoft), TA445 (Proofpoint), UAC-0051 (CERT-UA), Moonscape (Secureworks) and Repeating Umbra (CrowdStrike). Some, including Google Threat Intelligence, also list “Ghostwriter” as a name for it.
The assessment is supported by strong technical continuity with the May 2026 campaign, consistent tradecraft and targeting, and separate attribution by Google Threat Intelligence:
- Continuity with May 2026: the same phishing page. Apart from the single line holding the relay address, the credential page served in September 2026 is identical to the page used in the May 2026 campaign, which Google Threat Intelligence attributed to UNC1151.
- Continuity with May 2026: the same backend software on a new server. The operator-side system, the part a victim never sees, behaves the same way as the May 2026 servers, although it now runs on a different host at a different provider.
- Consistent tradecraft and targeting:
- real Gmail sender accounts with the recipient hidden in Bcc;
- a compromised third-party website as the redirector;
- Russian-language “your Google account will be deleted in 24 hours” lures;
- an operator-in-the-loop relay;
- targets in the Belarusian democratic movement.
- Google Threat Intelligence attribution. As of 29 October 2026, Google Threat Intelligence associates both the landing domain and the relay host of this campaign with UNC1151.
Points 1–3 show that the same operator ran the May 2026 and September 2026 campaigns. Point 4 ties this campaign’s own infrastructure to UNC1151.
Google/Mandiant has publicly assessed with high confidence that UNC1151 is linked to the Belarusian government, and has reported that the Ghostwriter campaign is aligned with Belarusian government interests (1). Mandiant has also reported that UNC1151 likely provides technical support to Ghostwriter (2).
Wider activity (context; not in the IoC table)
- Parallel Polish-language campaign. Since at least early May 2026, the same toolkit has been deployed on several dozen Polish-language fake Google “two-step verification” pages. Most are hosted on free platforms (Netlify, Vercel, Tencent EdgeOne, InfinityFree). Google Threat Intelligence associates most of the infrastructure we checked from this campaign with UNC1151 as well. We also found another Russian-language phishing page, from June 2026, running the same Russian-language version of the toolkit as this attack. In the pages we examined, the language is written into the page itself rather than chosen according to the visitor’s browser language or location.
- An operation-wide infrastructure change. From mid-September 2026, around the time this email was sent, new phishing pages across the operation — not only the one aimed at this target — used free ngrok tunnels for the relay channel. The cheaper setup seen here is an operational shift, not a one-off.
- Still active. The phishing page was still online on 28 October 2026 (see the public scan above). The operator backend listed below has been active since June 2026 and was still active at the end of October 2026, alongside at least one other backend server.
- Compromised redirector. Besides the redirector used in the email, the same location on the compromised site contained additional attacker-planted redirectors and a web shell. The site owner and hosting provider should treat the server as fully compromised.
Indicators of Compromise
| Type | Indicator | Notes |
|---|---|---|
| Email — sender | [email protected] | Real Gmail account used to send the phish |
| Email — display name | Account Support | Plain ASCII |
| Email — subject | Уведомления (“Notifications”) | Russian |
| Email — Message-ID | <CAFHUYFKMPV_=KNP1ma0p2hfeh-3braoktk52jFLuoHLwTLVbRA@mail.gmail.com> | For mailbox searches |
| Email — delivery | 2026-09-14, 08:34 UTC | To: undisclosed-recipients:; with the target in Bcc |
| URL — redirector (link in email) | hxxps://orlica[.]com/files/medias/media/center.php | Compromised legitimate site; 301 → www.orlica[.]com, then 302 to the pretext page |
| Domain — compromised | orlica[.]com | Legitimate site (victim); block the URL path rather than the whole domain |
| IP — redirector host | 46.248.189.158 | AS47544 IQ PL; shared hosting, context only |
| URL — pretext page | hxxps://profile-checker.gt[.]tc/profile.html | Title: Сведения об ограничении доступа к сервису |
| URL — credential page | hxxps://profile-checker.gt[.]tc/ | Title: Верификация учетной записи Google |
| Domain — landing | profile-checker.gt[.]tc | Free InfinityFree subdomain; do not block the parent gt.tc |
| IP — landing host | 185.27.134.227 | AS34119 (InfinityFree); shared hosting, context only |
| WebSocket — relay | wss://throng-snowy-shawl.ngrok-free[.]dev/ws | Credential and 2FA relay channel |
| Domain — relay tunnel | throng-snowy-shawl.ngrok-free[.]dev | Randomly named ngrok tunnel; short-lived |
| IP — operator backend | 111.88.74.246 | AS210734 IPHOSTER OU, Frankfurt, DE; active June–October 2026 |
| SHA-256 — pretext page | 37f4227bac4a90cc8db7146a7b458c5cd3655b69aec6a2c950401044d4c16fa6 | profile.html as served on 2026-09-15 |
| SHA-256 — credential page | d3475253fb88e53216375d22f6b3360f816eea0a0ddb3d61a9495139a05b4dba | Credential page as served on 2026-09-15 |
| Public scan | https://urlscan.io/result/01a182f6-a49a-71cb-8bdb-f4154fdf7ba4/ | Live page, 2026-10-28 |
| Attachments | none | Link-only attack |
MITRE ATT&CK
The table separates what we observed in this incident from what the kit is built to do and from the attacker’s end goal. Because the recipient did not click, nothing after the email delivery was observed against this recipient.
| Tactic | Technique | In this campaign | Status |
|---|---|---|---|
| Resource Development | T1585.002 — Establish Accounts: Email Accounts | Gmail account used as the sender | Observed |
| Resource Development | T1584.004 — Compromise Infrastructure: Server | Hacked Polish website hosts the redirector and a web shell | Observed |
| Resource Development | T1583.006 — Acquire Infrastructure: Web Services | Free web hosting (InfinityFree) and a free ngrok tunnel | Observed |
| Resource Development | T1583.003 — Acquire Infrastructure: Virtual Private Server | Operator backend at IPHOSTER OU | Observed (whether rented or otherwise obtained is not established) |
| Resource Development | T1608.005 — Stage Capabilities: Link Target | Redirector, pretext page and credential page staged before the email | Observed |
| Reconnaissance | T1598.003 — Phishing for Information: Spearphishing Link | Email link leading to fake Google pages built to harvest credentials | Observed (email delivered) |
| Defense Evasion | T1656 — Impersonation | Google branding and the “Account Support” sender name | Observed |
| Defense Evasion | T1036 — Masquerading | Appeal button shows a genuine Google URL on hover | Observed |
| Credential Access | T1111 — Multi-Factor Authentication Interception | SMS and authenticator codes relayed to the operator in real time | Kit capability (not observed against this recipient) |
| Credential Access | T1621 — Multi-Factor Authentication Request Generation | Victim shown the number needed to approve a genuine Google prompt triggered by the operator’s sign-in | Kit capability (not observed against this recipient) |
| Initial Access | T1078.004 — Valid Accounts: Cloud Accounts | Use of the stolen Google account | Objective (not observed) |