techcrunch.com web signal

Google Sues AI Phishing Ring Outsider Enterprise

6 sources tracking this story
google cybersecurity ai-crime phishing

Key insights

  • Outsider Enterprise has five specialized divisions (developer, data broker, spammer, theft, Telegram coordination), a corporate hierarchy enabling phishing-as-a-service at industrial scale.
  • The group bypassed Gemini's safety guardrails by framing malicious HTML-generation requests as innocent tasks like building gift redemption pages.
  • This is Google's second phishing-as-a-service enforcement action in seven months, signaling litigation as a standing anti-fraud instrument.

Why this matters

The Outsider Enterprise lawsuit is Google's first civil action targeting direct misuse of its own Gemini model, creating a legal template that links injunctive relief to FBI domain seizures under Operation Ghost Hook and carrier partnerships with AT&T, T-Mobile, Verizon, and Lumen. The $88-per-week subscription structure with 290-plus ready-made templates commoditized enterprise-grade phishing, and multiple outlets independently confirmed 3.87 million stolen credit card numbers and $1.9 billion in losses drawn from Google's own complaint filings. Crypto holders face compounded exposure: Decrypt reports phishing sites explicitly targeted cryptocurrency wallets and exchange credentials at a moment when FBI data shows crypto fraud complaints reached $11 billion in losses in 2025. Google's filings acknowledge that Chinese defendants rarely face extradition, positioning the suit's primary value as infrastructure disruption rather than criminal prosecution.

Summary

Google has sued Outsider Enterprise, a Chinese cybercrime network that turned phishing into a subscription product using AI. Operators pay $88 per week or $200 per month for access to 290-plus templates mimicking banks, telecoms, and government agencies. Using Google's own Gemini among other AI platforms, they built 9,000 fake sites and 1 million fraudulent domains, sending 2.5 million texts to Android users in just two weeks. Essentially: (Google, FBI) vs. Outsider Enterprise. - The FBI links the platform to $1.9 billion in losses and 3.87 million stolen credit cards since July 2023. - Google blocks more than 10 billion scam messages monthly, partnering with AT&T, T-Mobile, and Verizon to intercept messages. - Four internal groups handle development, targeting, delivery, and cash-out, all coordinating through Telegram. When phishing kits rent by the week, takedowns reduce volume but rarely end the threat.

Potential risks and opportunities

Risks

  • Outsider Enterprise's developer group could reconstitute the subscription platform under new domains quickly if seized infrastructure targets only URLs rather than the underlying operators.
  • The 3.87 million credit card holders whose data was already stolen face ongoing fraud exposure regardless of how the lawsuit resolves.
  • Other AI platform operators face immediate pressure to demonstrate their tools are not being used at scale to generate phishing templates, creating compliance and reputational risk across the sector.

Opportunities

  • Google's civil litigation strategy creates a replicable playbook for other AI platform operators to pursue criminal networks misusing their infrastructure without relying solely on law enforcement.
  • AT&T, T-Mobile, and Verizon can market their demonstrated AI-powered SMS filtering as a differentiated enterprise security offering following their coordinated response with Google.
  • The FBI's detailed financial damage estimates, $1.9 billion in losses and 3.87 million stolen cards, provide prosecutors a strong evidentiary foundation for parallel criminal charges that could reach individual Outsider Enterprise operators.

What we don't know yet

  • Whether Google's discovery that Gemini was used to generate phishing content will trigger platform-level AI usage audits or new detection policies at Google.
  • Whether the specific individuals behind Outsider Enterprise are named in the complaint, as public reporting only identifies the group by its platform name.
  • Whether the FBI-coordinated domain seizures also disrupted the Telegram channels Outsider Enterprise used to coordinate its four internal groups.

What others are reporting

Coverage cluster as of 8h after publish

  1. The Hacker News Read →

    Breaks down Outsider Enterprise into five named operational divisions and details how members prompt-engineered Gemini to bypass safety filters using disguised coding requests.

    The operation weaponized Gemini to help generate fraudulent phishing pages and deploy massive SMS phishing attacks.
  2. Cryptopolitan Read →

    Frames this as Google's second phishing-as-a-service action in seven months and carries FBI Assistant Director Brett Leatherman's on-record statement tying AI to fraud escalation.

    Criminals increasingly use AI to make fraud like this more convincing and harder to detect.
  3. The Next Web Read →

    Contrasts this suit with Google's November 2025 phishing-as-a-service case, covers telecom coordination, and notes the complaint itself lacks confirmed victim count or total financial loss.

    The same tools built to assist developers are being repurposed by criminal networks.
  4. Decrypt Read →

    Adds the crypto dimension: sites targeted cryptocurrency wallets and exchange credentials, with FBI data showing crypto fraud complaints reached $11 billion in losses across 2025.

    Our suit targets core software developers in a cybercrime operation known as Outsider Enterprise.
  5. TechRadar Read →

    Highlights Google's own acknowledgment that Chinese defendants rarely face extradition, framing the lawsuit's value as infrastructure disruption rather than a path to criminal conviction.

Originally reported by techcrunch.com

Read the original article →

Original headline: Google Sues AI-Powered Chinese Phishing Ring 'Outsider Enterprise' — 9,000 Fake Sites, 1M Fraudulent Domains, $1.9B Estimated Losses Since 2023