UNC1151 phishing infrastructure exposes a broader credential campaign

At a glance

What this is: This is a threat intelligence analysis showing that a single phishing email was linked to a broader UNC1151 credential-theft campaign spanning fake login pages and reused hosting patterns.

Why it matters: It matters because identity and email teams need to treat phishing as an infrastructure problem as well as a user-facing lure, especially when attackers relay credentials live and hide behind CDNs.

Context

Credential phishing is no longer just about a convincing email. In campaigns like this one, attackers pair impersonation pages with infrastructure reuse, real-time credential relay, and domain patterns that reveal a wider operation behind a single message. For IAM and security teams, that means the control problem extends beyond mailbox filtering into authentication, token handling, and external exposure monitoring.

This article sits at the intersection of identity verification, phishing defence, and attack surface analysis. The practical lesson is that a phishing page can be only the visible edge of a credential theft chain, while the real signal often appears in certificates, hostnames, CDN usage, and repeated infrastructure fingerprints.

Key questions

Q: What breaks when phishing sites relay credentials in real time?

A: Real-time relay collapses the gap between theft and use. Passwords, OTPs, and some session tokens can be captured and acted on before normal user or SOC checks intervene. The practical failure is that classic phishing assumes delayed reuse, while websocket or proxy-based relays can convert a login into an immediate compromise path.

Q: Why do phishing campaigns use CDN masking and certificate reuse?

A: CDN masking makes origin attribution harder, while certificate reuse and repeated host patterns expose the operator behind the lure. Defenders should treat certificates, DNS records, and shared hosting artefacts as campaign evidence, not just technical clutter. Those pivots often reveal the broader infrastructure family that single-email analysis misses.

Q: What are the signs that a phishing campaign is part of a larger multi-stage malware operation rather than a one-off lure?

A: Look for repeated lure themes, shared sender infrastructure, consistent macro logic, staged payload delivery, and follow-on files that unpack into later modules. Multi-stage operations usually show clear sequencing from initial attachment to downloader, loader, and RAT components. If those stages appear across multiple campaigns, the activity is more likely part of an enduring intrusion program than an isolated email event.

Q: How should security teams respond when credentials may have been entered into a fake login page?

A: Treat the account as exposed until proven otherwise. Revoke active sessions, review recent sign-ins, check token issuance and mailbox forwarding rules, and look for related phishing domains or certificates. If the target is high-risk, move quickly to phishing-resistant authentication and user notification before further abuse spreads.

Technical breakdown

How phishing infrastructure hides behind CDNs and reused certificates

Attackers use content delivery networks, shared hosting, and certificate reuse to make phishing infrastructure harder to trace. The visible domain may front a completely different origin IP, while certificates on that origin can reveal related hostnames, hosting patterns, and reuse across campaigns. That turns passive infrastructure data into attribution evidence. In this article, the same IP and certificate patterns linked multiple impersonation domains to a single operator set, which is exactly why certificate transparency and host correlation matter in threat hunting. The technical point is that a phishing site is rarely isolated. It usually sits inside a repeatable build and hosting pattern that defenders can search for.

Practical implication: Use certificate and hosting pivots to find sibling phishing domains, not just the page reported by a victim.

Why real-time credential relay defeats simple multi-factor assumptions

The phishing page in this campaign forwarded entered data over a websocket in real time, which means the operator could capture credentials as they were typed and potentially use them before the session expired. That changes the defensive model. A static stolen password is one problem, but live relay can also support OTP capture, MFA bypass, and fast token abuse if the authentication flow is weakly bound to the session or device. The mechanism is important because many teams still think of phishing as delayed reuse of harvested credentials, when the actual window of abuse can be immediate.

Practical implication: Strengthen phishing-resistant authentication and monitor for impossible travel, rapid token use, and session anomalies.

What infrastructure pivots reveal about campaign scope

Infrastructure pivots help separate a one-off lure from a broader operator playbook. Repeated TLD choices, similar domain naming conventions, shared WebSocket endpoints, and mirrored certificate patterns suggest a campaign architecture rather than an isolated phishing attempt. That matters for defenders because it widens the search from a single victim interaction to a potentially much larger set of exposed domains, accounts, and impersonated brands. In practical terms, the question is not whether one user clicked, but how many related domains, certificates, and delivery paths remain active in the environment.

Practical implication: Search for shared naming, hosting, and certificate patterns to assess campaign spread and residual exposure.

Threat narrative

Attacker objective: The attacker aimed to capture login credentials from targeted users and use the same infrastructure pattern across a broader credential theft campaign.

1. Entry occurred through a Gmail phishing email that impersonated Google and urged the target to verify suspicious activity.
2. Credential harvesting happened on a fake Google login page that relayed typed input in real time to an operator-controlled websocket endpoint.
3. Impact was the potential theft and immediate abuse of account credentials in a broader multi-national phishing campaign tied to UNC1151.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential phishing has become an infrastructure problem, not just a message-content problem. The article shows how certificate pivots, repeated hostnames, and origin-IP reuse can expose a campaign even when the phishing email itself is ordinary. That means detection must extend beyond mailbox controls into infrastructure intelligence and identity telemetry. Practitioners should treat exposed hosting patterns as first-class hunting signals.

The decisive control gap is real-time session abuse, not just password exposure. The websocket relay means the operator was not waiting to reuse stolen credentials later. The attack path compresses capture and use into the same interaction window, which weakens assumptions behind traditional password and OTP defences. Teams should prioritise phishing-resistant authentication and session-binding controls.

Identity verification fails when the user sees a familiar brand but the infrastructure tells a different story. Impersonation of Google and popular Ukrainian portals worked because users were presented with a trusted surface while the backend remained attacker-controlled. That is the verification trust gap: the user authenticates the appearance, while the attacker owns the origin. Practitioners should verify the provenance of authentication flows, not just their visual fidelity.

Campaign attribution now depends on operational repetition, not a single IOC. Reused CDN masking, shared certificate behaviour, and similar domain naming patterns point to a durable operator model. For defenders, that means one bad page should trigger a broader domain and certificate review. The practical conclusion is to hunt for campaign families, not isolated phishing pages.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.

What this signals

Verification trust gap: phishing is increasingly a problem of proving which authentication flow is real, not just detecting suspicious email content. Once attackers can mirror a login page and relay input live, user recognition alone becomes a weak control. Security teams should shift toward provenance checks, phishing-resistant authentication, and campaign-level infrastructure hunting.

Identity and email controls need to converge with external attack surface monitoring. The same certificate and hostname pivots that expose a phishing cluster can also reveal how far a campaign has spread, which makes infrastructure telemetry a core input to identity incident response.

For practitioners

• Hunt for infrastructure siblings Search certificate transparency, origin IPs, and hostname patterns for domains that share naming conventions, CDN masking, or repeated hosting behaviour with a known phishing page.
• Prioritise phishing-resistant authentication Move high-risk users and external-facing accounts toward FIDO2 or equivalent phishing-resistant methods, especially where live credential relay can defeat OTP-based flows.
• Correlate identity telemetry with web intel Tie unusual sign-in events, token reuse, and impossible-travel alerts to observed phishing infrastructure so that suspicious authentication attempts are investigated as a campaign, not a single login.
• Review externally exposed login flows Map all login and verification surfaces that can be impersonated and ensure they are covered by monitoring, takedown processes, and user reporting paths.

Key takeaways

• The article shows that credential phishing can be built as a reusable infrastructure pattern, not just a one-off lure.
• Live credential relay compresses capture and abuse into the same interaction window, which weakens password and OTP reliance.
• Defenders need to combine identity telemetry, certificate pivots, and hostname analysis to see the full campaign.

Key terms

• Credential Relay: Credential relay is the immediate forwarding of captured authentication material from a phishing environment to the legitimate service. It is dangerous because it converts a one-time code or token into an active access path before the victim can react or the session can expire.
• Certificate Pivoting: A threat hunting technique that uses certificate metadata, hosting reuse, and related hostnames to uncover linked infrastructure. It is especially useful when attackers hide behind CDNs or rotate domains while keeping the same backend services.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Identity Telemetry: Identity telemetry is the collection of signals generated by authentication, session, and access events across human and non-human identities. It becomes useful for governance when teams can baseline normal behavior and detect drift in source, privilege, or access frequency.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is useful for practitioners who need to connect identity controls to real-world attack patterns and governance decisions.