Police officers surround a man (C) suspected to be involved in an attack on a beachside hotel in Sousse, Tunisia June 26, 2015.[Photo/Agencies]

Update: The victim toll grew to 37 killed, 36 injured, in the deadly hotel attack, said the Tunisian Ministry of Health.

TUNIS - A gunman disguised as a tourist opened fire at a Tunisian hotel on Friday with a weapon he had hidden in an umbrella, killing 28 people, including British, German and Belgian tourists, as they lounged at the beach and pool in a popular resort town.

Terrified tourists ran for cover after the gunfire and an explosion erupted the Imperial Marhaba in Sousse resort town, 140 km south of the capital Tunis, before police shot the gunman dead, witnesses and security officials said.

The attack took place during the holy Muslim month of Ramadan, on a day in which a decapitated body daubed with Arabic writing was found in France, a suicide bomber killed two dozen people at a mosque in Kuwait and at least 145 civilians were reported killed by Islamic State militants in northern Syria.

It was the second major attack on Tunisia this year following the Islamist militant assault on Tunis Bardo museum when gunmen killed 21 foreign visitors.

The body of the attacker lay with a Kalashnikov assault rifle where he was shot. Local radio said police captured a second gunman, but officials did not immediately confirm the arrest or his role in the attack.

"One attacker opened fire with a Kalashnikov on tourists and Tunisians on the beach of the hotel," said a hotel worker at the site. "It was just one attacker. He was a young guy dressed in shorts like he was a tourist himself."

The man, dressed in shorts, pulled out a weapon he had hidden inside an umbrella he was carrying before opening fire at the beach and pool and tossing an explosive, witnesses said. A security source said another bomb was found on his body.

A health ministry statement said British, German and Belgian nationals were among the 28 dead. Six other people were wounded in the shooting, officials said.

No one immediately claimed the attack. But Islamist jihadists have attacked North African tourist sites before, seeing them as legitimate targets because of their open Western lifestyles and tolerance of alcohol.

Irishwoman Elizabeth O'Brien, who was staying at a neighbouring hotel with her two sons, said there was panic on the beach when gunfire erupted.

"I honestly thought it was fireworks and then when I saw people running... I thought, my God, it is shooting," she told Irish radio station RTE. "The waiters and the security on the beach started to say 'Run, run, run!'"

Sousse, alongside nearby Hammamet and the island of Djerba, is the heartland of Tunisia's most popular beach resorts, drawing visitors from Europe and neighbouring North African countries like Algeria.

Six million tourists, mostly Europeans, visited Tunisia's beaches, desert treks and medina souks last year, providing seven percent of its gross domestic product, most of its foreign currency revenues and more jobs than anything but farming.

"This is a catastrophe, but we have to stay strong," Tourism Minister Salma Loumi said.