Google has initiated legal action aimed at dismantling what it describes as a substantial AI-driven cybercrime network.
On Friday, the tech giant revealed it is suing a purported Chinese cybercrime organization known as Outsider Enterprise. Google claims this group uses artificial intelligence to orchestrate campaigns that send fraudulent text messages mimicking Google and other well-known brands in a bid to obtain passwords and credit card details.
According to Google, Outsider Enterprise has defrauded “hundreds of thousands of victims,” leading to financial losses that are “estimated in the millions.” The group has set up an impressive 9,000 counterfeit websites and one million deceptive web domains, sending out around 2.5 million scam texts to Android users over a mere two weeks.
The scale of the operation is staggering; in just two weeks this past May, Android users flagged 55,000 spam texts to Google—equating to more than two complaints per minute.
Google reported that it employs advanced “AI-powered tools to combat AI-driven scams.” These tools not only help identify fraudulent activities but also notify users about suspicious calls and texts, allowing for the interception of over 10 billion scam messages per month.
The tech firm has partnered with AT&T, T-Mobile, and Verizon to block these fraudulent messages and is also coordinating with the FBI. An FBI spokesperson confirmed that, in collaboration with Google and Lumen’s Black Lotus Labs, several domains used by the cybercriminals have been seized, along with Shopify accounts that were testing phishing operations.
Since July 2023, Outsider Enterprise’s phishing platform has allegedly facilitated the theft of around 3.87 million credit cards, resulting in losses estimated at $1.9 billion.
In its lawsuit, Google presented evidence against those involved with Outsider Enterprise, identifying them as unknown foreign cybercriminals. According to the complaint, these individuals have developed a “turn-key, online software suite” that empowers criminals, regardless of their tech expertise, to create fake websites that facilitate theft from victims.
The software, referred to as Outsider, is available for $88 weekly or $200 monthly. It allows users to easily generate counterfeit websites using AI technologies, including Google’s own AI model, Gemini. These fraudulent websites often impersonate telecom companies, financial institutions, government entities, and retailers to deceive victims.
To drive traffic to these fake sites, the criminals exchange malicious text messages or invest in advertising. Their ultimate objective is to extract passwords and multi-factor authentication codes, as well as financial details, through the data victims enter on these counterfeit websites, with the information transmitted via Outsider’s platform in real time.
Google noted the appeal of the Outsider software lies in its usability for individuals with minimal technical backgrounds—many of its users are reported to collaborate via Telegram channels, where they share strategies, train each other, and refine phishing exploits.
The Outsider platform allegedly boasts over 290 pre-made templates that closely resemble legitimate websites, allowing users to create replica sites in mere minutes. The software also includes guides on deploying AI-generated code for nefarious purposes, along with a dashboard for tracking the success of phishing campaigns. It has been suggested that the criminals utilize Google Drive and the Google Cloud for hosting their phishing operations.
The degree of Outsider Enterprise’s activities is noteworthy; Google discovered over 1.59 million URLs linked to this operation within a span of five months, from November 14, 2025, to April 14, 2026.
The structure of Outsider Enterprise includes multiple factions: those who design and maintain phishing software and website templates, others who compile target lists from public records and social media, a group dedicated to mass text messaging, and individuals who launder profits garnered from stolen credentials.
Google claims that the cybercriminals have pilfered “at least 36,000 payment cards issued by financial institutions across 95 countries.”
The tech giant alleges that Outsider Enterprise has impersonated its brands, engaged in copyright infringement, committed racketeering and wire fraud, and has been involved in false advertising. As part of the lawsuit, Google seeks both compensatory and punitive damages, as well as an injunction to prevent the continuation of these illicit activities.
