Google launched a landmark lawsuit in a US federal court on Friday against a prolific Chinese cybercrime syndicate known as Outsider Enterprise, aiming to dismantle an AI-powered phishing network that has defrauded hundreds of thousands of victims of millions of pounds.
According to the tech giant’s official announcement, the group deploys advanced artificial intelligence to send deceptive text messages. These messages impersonate Google and other major brands to harvest passwords, multi-factor authentication codes, and credit card details from unsuspecting users.
A Multi-Million Pound Phishing Empire
The scale of the Outsider Enterprise operation is staggering. Over a mere two-week period, the group deployed 9,000 fraudulent websites, registered over one million spoofed web domains, and blasted 2.5 million scam text messages to Android users. Google reports that during a single fortnight in May, Android users flagged 55,000 spam texts—averaging more than two complaints every minute.
To counter this threat, Google is employing its own AI-driven security tools to identify and block malicious activity, intercepting over 10 billion scam messages globally every month. The tech giant has also partnered with major telecommunications providers, including AT&T, T-Mobile, and Verizon, whilst coordinating closely with law enforcement.
An FBI spokesperson confirmed that, in a joint effort with Google and Lumen’s Black Lotus Labs, federal agents seized several domains, Shopify storefronts, and testing accounts linked to the operation. The FBI estimates that since July 2023, the platform has enabled cybercriminals to compromise at least 3.87 million credit cards, resulting in approximately $1.9 billion in financial losses.
How ‘Outsider’ Lowered the Bar for Cybercrime
In its legal complaint, Google detailed how the syndicate operates. The masterminds behind Outsider Enterprise, whose true identities remain shielded abroad, created a highly accessible, subscription-based software suite that allows low-skilled criminals to launch sophisticated phishing attacks.
‘Phishing for Dummies’ Powered by AI
Dubbed “Outsider”, the software is leased to users for $88 per week or $200 per month. The suite leverages public AI platforms—including Google’s own Gemini model—to generate highly convincing replicas of websites belonging to banks, telecom operators, retail brands, and government agencies. Once a victim is lured to these fake sites via targeted ads or SMS spam, their credentials and financial details are harvested and transmitted back to the scammers in real time.
Google highlights that the syndicate brazenly coordinates its activities on public Telegram channels. On these platforms, members share strategies, trade tips, and help novice hackers execute attacks. The Outsider software package includes over 290 pre-built website templates, tutorials on weaponising AI-generated code, and an administrative dashboard to monitor active campaigns. Shockingly, the cybercriminals even utilised Google Drive and Google Cloud infrastructure to host their malicious pages.
The sheer volume of the campaign is immense. Between 14 November 2025 and 14 April 2026, Google’s security systems detected more than 1.59 million unique URLs linked to the Outsider network.
An Organised, Multi-Tiered Syndicate
According to court filings, Outsider Enterprise operates like a corporate business, divided into specialised divisions. The syndicate comprises core software developers who maintain the templates; data brokers who source victim lists from public records and breaches; a “spammer” faction equipped with physical hardware like SIM farms and modems to send bulk SMS; and financial operatives who launder the stolen funds.
Google’s internal investigation revealed that the group has compromised at least 36,000 payment cards across 95 different countries. The lawsuit accuses the defendants of racketeering, wire fraud, copyright infringement, trademark dilution, and false advertising. Google is seeking both compensatory and punitive damages, alongside a permanent injunction to dismantle the syndicate’s digital infrastructure.