Phishing texts that mimic a bank alert or package delivery notification usually point to a fake website designed to capture passwords and card numbers. Google One criminal network says it used artificial intelligence to build these sites on a scale that no human team could match.
Google has filed a civil suit against that network, a China-based operation it calls Outsider Enterprise, accusing it of using Gemini and other artificial intelligence models to mass produce phishing sites. TechCrunch I mentioned The complaint filed in Manhattan federal court links the network to more than 9,000 fake websites and more than 1.5 million fraudulent URLs.
On Friday (June 12) Blog post Announcing the lawsuit, Google said that during a two-week period in May, Android users reported 55,000 spam text messages related to the process, generating more than two complaints per minute.
Artificial intelligence turns programming requests into phishing pages
Google complaint Details how Outsider Enterprise members allegedly prompted Gemini and other AI platforms with requests framed as ordinary crypto tasks. One example cited in the file asks the AI model to write code for a gift redemption page, then feed that output into Outsider software to turn it into a live scam site.
According to the lawsuit, the platform compiled more than 290 pre-created templates to copy banks, telecom companies, retailers and government agencies.
“For a subscription fee as low as $88 per week, the Outsider phishing group allows its users to create fraudulent websites, launch phishing campaigns, and steal victims’ credit card numbers, bank account credentials, and personal data,” according to Google’s complaint.
Advertisement: Scroll to continue
In order to reach victims, network members allegedly sent text messages impersonating Google, YouTube, the postal service, and other brands. The messages directed recipients to AI-generated sites, where victims entered passwords, card numbers and other personal data, according to the complaint.
An organized criminal network is like a business
Google’s complaint described Outsider Enterprise as a collection of coordinated groups rather than a single operation. One group allegedly builds and maintains phishing programs and templates, while another provides lists of targets drawn from public records, social media, and past data breaches. A third group operates SIM cards and modems used to send fraudulent text messages in bulk. A fourth group converts the stolen credentials into money and launders the proceeds. Google said participants discuss strategy and coach each other openly through Telegram channels.
The financial scope is large. TechCrunch I mentioned Outsider Enterprise’s phishing platform enabled the theft of at least 3.87 million credit card numbers and about $1.9 billion in losses since July 2023, the FBI said.
Google said that the latest campaign alone deceived hundreds of thousands of victims, with losses estimated at millions.
An earlier version of Outsider was linked to the theft of at least 36,000 payment cards issued by banks in 95 countries, according to Google’s complaint. This prior activity predates the release of the AI-powered platform that is now the focus of the lawsuit.
Carriers and legislators
Google said it is coordinating with the FBI on enforcement actions, and is working with AT&T, T-Mobile and Verizon to prevent fraudulent text messages before they reach phones. Google said its detection systems already intercept more than 10 billion malicious messages per month.
TechCrunch reported that the FBI, working with Google and Lumen’s Black Lotus Labs, seized domains and Shopify storefronts that the network used to test the phishing service, along with a Telegram bot that the network used to sell software subscriptions.
The complaint also accuses the network of hosting phishing pages on Google Cloud and Google Drive and copying Google’s trademarks to make scam sites appear legitimate.
According to its blog post, Google is calling for federal legislation aimed at coordinating responses to AI-enabled fraud, including bills introduced by Reps. Brian Fitzpatrick and Josh Harder that would direct law enforcement, government, and industry to work together against organized fraud networks.
The lawsuit accuses Outsider Enterprise of racketeering, trademark infringement, wire fraud and false advertising, and asks the court to issue an injunction and damages.
