Chinese cybercrime operation that used AI to scam ‘hundreds of thousands of victims’ sued by Google
Google has filed a lawsuit to dismantle a large AI-powered Chinese cybercrime network called Outsider Enterprise, which allegedly scammed hundreds of thousands of victims out of millions of dollars by using AI to generate fake websites and send scam text messages.
Intelligence analysis by Gemini 2.5 Flash
Google is taking legal action against Outsider Enterprise, a Chinese cybercrime group accused of leveraging AI, including Google's Gemini, to create sophisticated phishing operations. This network reportedly employs a "phishing-for-dummies" software to enable individuals with limited technical skills to deploy fraudulent websites and engage in large-scale scamming, resulting in substa…
Imagine some tricky people in a far-off land are using super-smart computer programs, like a really clever robot, to trick grown-ups. They make fake websites that look like places grown-ups trust, like their bank or phone company. Then, they send sneaky text messages pretending to be from those places, trying to get people to click on the fake websites and give away their secret numbers, like passwords or credit card info. Google found out about this big scam and is now taking them to court to try and stop them, like a superhero trying to catch the bad guys.
Analysis
Google has initiated a lawsuit to dismantle Outsider Enterprise, an alleged Chinese cybercrime network that it claims uses AI in its operations. The tech giant states that this group sends scam text messages impersonating Google and other brands to steal passwords and credit card numbers, resulting in “hundreds of thousands of victims” and losses “estimated in the millions.”
Google's investigation revealed that Outsider Enterprise deployed 9,000 fake websites and one million fraudulent web domains, sending 2.5 million texts to Android users in a two-week period. The company also noted a significant volume of spam, with “55,000 spam texts were flagged by Android users in just two weeks this past May.”
To counter these threats, Google states it utilizes “AI-powered tools to fight AI-powered scams,” intercepting over 10 billion scam messages monthly. Collaborations with major telecom providers like AT&T, T-Mobile, and Verizon are ongoing to block these fraudulent messages. The FBI, coordinating with Google and Lumen’s Black Lotus Labs, has seized several domains and Shopify accounts linked to the cybercriminals. The FBI spokesperson indicated that since July 2023, Outsider Enterprise’s phishing platform is estimated to have stolen “at least an estimated 3,870,000 stolen credit cards and a corresponding estimated $1.9B in losses.”
Inside Outsider Enterprise
Google's complaint details that the alleged foreign-based cybercriminals behind Outsider Enterprise developed a “turn-key, online software suite” that enables individuals, regardless of technical skill, to create fraudulent websites. This software, named Outsider, costs $88 per week or $200 per month and allows operators to build fake websites using AI platforms, including Google’s Gemini. These sites impersonate various services such as telecom providers, financial institutions, and government agencies.
The cybercriminals collaborate through Telegram channels, where they coordinate efforts, share strategies, and provide training. The Outsider platform allegedly offers “more than 290 pre-built templates” for creating replicas of legitimate websites “in minutes,” along with guides on how to “weaponize AI-generated code” and a dashboard to monitor phishing campaigns. Google also stated that the cybercriminals have used Google Drive and Google Cloud infrastructure to host these phishing websites.
The operation is segmented into several groups: developers of the phishing software, suppliers of target lists, a “spammer group” providing bulk text messaging tools, and those who monetize stolen credentials and launder money. Google claims that at least 36,000 payment cards from 95 countries have been stolen. The lawsuit seeks compensatory and punitive damages and a court order to halt these illicit activities.
Key points
- Google is suing a Chinese cybercrime network, Outsider Enterprise, for using AI to scam hundreds of thousands of victims.
- The operation used AI, including Google's Gemini, to create 9,000 fake websites and send millions of scam text messages.
- Victims have suffered millions in losses, with an estimated $1.9 billion in stolen credit cards since July 2023.
- Google uses its own AI tools to fight these scams, intercepting over 10 billion scam messages monthly.
- The cybercrime group offers a 'phishing-for-dummies' software with pre-built templates and collaborates via Telegram.
Google's proactive lawsuit demonstrates a strong stance against the weaponization of AI for cybercrime, potentially leading to the dismantlement of major criminal networks and setting a precedent for tech companies to legally pursue malicious actors. This action, coupled with Google's AI-powered security tools and collaborations with law enforcement, could enhance global cybersecurity defenses and protect more users from advanced scams.
Despite Google's efforts, the ease with which sophisticated AI tools can be used to create widespread scams, especially with readily available "phishing-for-dummies" software, suggests that cybercrime will continue to evolve and pose significant challenges. The foreign-based nature and unknown identities of the criminals make full eradication difficult, potentially leading to new iterations of these operations emerging with different infrastructures.
