\n<\/p>\n
Google is suing to dismantle the infrastructure behind an alleged massive AI-powered cybercrime operation.<\/p>\n
On Friday, the tech giant announced<\/a> a lawsuit against an alleged Chinese cybercrime network called Outsider Enterprise, which Google says uses AI in its campaigns to send scam text messages impersonating Google and other brands to steal passwords and credit card numbers.\u00a0<\/p>\n Outsider Enterprise has financially scammed \u201chundreds of thousands of victims\u201d with losses \u201cestimated in the millions.\u201d The group deployed 9,000 fake websites, one million fraudulent web domains, and 2.5 million texts sent to Android users in a two-week period, according to Google.\u00a0<\/p>\n The company said, \u201c55,000 spam texts were flagged by Android users in just two weeks this past May \u2014 that\u2019s more than two text spam complaints a minute.\u201d<\/p>\n Google said it uses \u201cAI-powered tools to fight AI-powered scams,\u201d which enable the company to detect scams and alert users of suspicious calls and text messages, leading to the interception of more than 10 billion scam messages a month.\u00a0\u00a0<\/p>\n The company said it has been collaborating with AT&T, T-Mobile, and Verizon to block the scam text messages, and said it is coordinating with the FBI.<\/p>\n An FBI spokesperson told TechCrunch that the bureau, in coordination with Google and Lumen\u2019s Black Lotus Labs, seized several domains used by the cybercriminals, as well as Shopify storefronts and accounts used to test the operation\u2019s phishing service.<\/p>\n The spokesperson said that since July 2023, Outsider Enterprise\u2019s phishing platform enabled cybercriminals to steal \u201cat least an estimated 3,870,000 stolen credit cards and a corresponding estimated $1.9B in losses.\u201d<\/p>\n In its complaint filed as part of the lawsuit<\/a>, Google laid out the evidence it gathered against people involved in the Outsider Enterprise operations, whom the company said are foreign-based cybercriminals whose real identities are unknown. This group \u201cbuilt, maintains, and uses a turn-key, online software suite that enables criminals, regardless of technical skill, to publish fraudulent websites designed to rob victims and enrich themselves,\u201d according to the complaint.\u00a0<\/p>\n Google said this \u201cphishing-for-dummies\u201d software called Outsider, which costs $88 per week or $200 per month, allows operators to create fake websites with the help of AI platforms, including Google\u2019s own Gemini. The fake sites impersonate several services and companies, such as telecom providers, financial institutions, government agencies, and retailers.\u00a0<\/p>\n To lure people to the fake websites, the cybercriminals collaborate with one another to send victims malicious text messages, or purchase ads. The common goal is to steal passwords and corresponding multi-factor codes as well as financial information, which the scammers can do by receiving the data that victims input into the fake websites, with the information being transmitted through Outsider\u2019s platform in real-time.\u00a0<\/p>\n \u201cPart of the Outsider software\u2019s appeal is the ease with which someone with limited technical expertise \u2014 like many members of the Enterprise\u2014 can purchase the software, execute various phishing attacks, and, upon purchase, meet other members of the Enterprise who are proficient in other areas,\u201d Google wrote, referring to Telegram channels where the cybercriminals can collaborate, train each other, discuss strategies, and develop phishing attacks. \u201cThe Enterprise brazenly coordinates its efforts in open and largely uncoded discussions on Telegram.\u201d\u00a0<\/p>\n According to Google, the Outsider platform allegedly offers cybercriminals \u201cmore than 290 pre-built templates that mimic the legitimate websites\u201d that generate replicas of real websites \u201cin minutes,\u201d along with guides on how to \u201cweaponize AI-generated code,\u201d as well as a dashboard to track how progress of phishing campaigns. The cybercriminals have allegedly used Google Drive and Google Cloud infrastructure to host the phishing websites.<\/p>\n \u201cThe Outsider software has been used to create over a million phishing websites to swindle innocent victims out of millions of dollars,\u201d Google wrote in the complaint.<\/p>\n To give an idea of the scale of Outsider Enterprise\u2019s operation, Google said that over a five-month period, from November 14, 2025 to April 14, 2026, the company detected more than 1.59 million URLs connected to it.\u00a0<\/p>\n Google said the Outsider Enterprise operation is made up of several groups of cybercriminals: those who develop and maintain the phishing software and website templates; those who supply lists of targets curated from public records, social media, and data breaches; a \u201cspammer group\u201d that provides tools and the <\/strong>infrastructure to send scam texts in bulk, which includes smartphone banks, SIM cards, and modems; and those who monetize the stolen credentials and launder the stolen money.<\/p>\n The cybercriminals have stolen \u201cat least 36,000 payment cards issued by financial institutions in 95 countries,\u201d according to Google.\u00a0<\/p>\n The company accused the people behind Outsider Enterprise of impersonating Google and its brands, of infringing its copyright, of racketeering activities, of committing wire fraud, and false advertising. With the lawsuit, Google is seeking compensatory and punitive damages, and an order to stop the criminals from carrying out their activities.<\/p>\n This story was originally published at 10:26 a.m. PDT and has since been updated with new information from Google\u2019s complaint, and the FBI\u2019s comment.<\/em><\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\nInside Outsider Enterprise<\/strong><\/h2>\n