Google Sues Chinese Smishing Ring That Weaponized
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Google filed suit in Manhattan federal court against the "Outsider Enterprise," accusing it of weaponizing Gemini to generate HTML code for phishing pages that mimic legitimate brands, prompting FBI Cyber Division assistant director Brett Leatherman to warn that "criminals increasingly use AI to make fraud more convincing and harder to detect."
- The Outsider phishing-as-a-service kit was sold via a Telegram bot (@OutsiderCodeBot) for $88/week or $200/month and offered 290+ pre-built impersonation templates, real-time keystroke logging, and a performance dashboard for tracking campaign effectiveness.
- The FBI estimates the platform accounts for 3.87 million stolen credit cards and $1.9 billion in losses between July 2023 and the present — a figure that significantly outpaces the "millions in losses" cited in Google's public framing of the case.
- Google identified 9,000 fake websites and 1.59 million fraudulent URLs tied to Outsider between November 14, 2025 and April 14, 2026, with 2.5 million phishing messages sent to Android users during a two-week window from May 18 to June 1, 2026.
- Operation Ghost Hook — part of the FBI's broader Operation Riptide — seized multiple domains, a Shopify storefront, and approximately $100,000 in USDT from Outsider payment wallets, and the @OutsiderCodeBot Telegram bot is now offline.
- Google is partnering with AT&T, T-Mobile, and Verizon to block smishing messages at the carrier level, representing an infrastructure-level disruption effort running parallel to the legal action.
- The suit comes exactly seven months after Google filed a separate lawsuit against operators of the Lighthouse phishing-as-a-service platform, a China-based operation that ensnared over 1 million users across 120 countries.
Why it matters: The AT&T, T-Mobile, and Verizon carrier partnerships represent a rare infrastructure-level disruption against smishing at the delivery stage, not just the domain stage. The FBI's $1.9 billion loss estimate, buried below Google's more modest "millions" figure, reveals the true scale of the operation. Google's second major lawsuit against a Chinese PhaaS operator in seven months signals an escalating legal posture against the smishing-as-a-service economy.
