Google filed a lawsuit on Friday seeking to dismantle an alleged Chinese cybercrime network called Outsider Enterprise, which the company says weaponized artificial intelligence to run phishing campaigns that defrauded "hundreds of thousands of victims" out of millions of dollars. The group primarily targeted Android users with scam text messages impersonating Google and other well-known brands, directing recipients to fraudulent websites designed to harvest passwords, credit card numbers, and other personal information. According to Google's complaint, Outsider Enterprise deployed roughly 9,000 fake websites backed by more than one million fraudulent web domains, and blasted out 2.5 million phishing texts in a two-week span earlier this year. In May alone, Android users flagged 55,000 spam texts, a rate Google said equates to more than two complaints every minute.
At the heart of the operation is a subscription-based phishing toolkit, also called Outsider, which Google described as a "phishing-for-dummies" software suite that lets criminals with little technical know-how spin up convincing fake websites. The service costs $88 per week or $200 per month, and since launching in July 2023 it has allegedly helped its users steal an estimated 3.87 million credit card numbers, racking up roughly $1.9 billion in losses. Google said it has been working with carriers AT&T, T-Mobile, and Verizon to block the fraudulent messages at the network level, and is now leaning on AI-driven detection systems of its own, which the company claims intercept more than 10 billion scam messages every month and alert users to suspicious calls and texts in real time.
The takedown effort is already producing results. An FBI spokesperson told reporters that the bureau, working alongside Google and Lumen's Black Lotus Labs, seized multiple domains tied to the operation along with several Shopify storefronts and accounts the criminals had been using to test their phishing infrastructure. The defendants named in Google's complaint are described as foreign-based actors whose true identities remain unknown, with the company framing the lawsuit as a way to expose the group's tactics and starve it of the infrastructure it depends on. Google executives said the case underscores a broader shift in the cat-and-mouse game between tech platforms and scammers, arguing that AI-powered threats now require AI-powered defenses at scale.