9,000 Fake Sites, 2.5M Texts: Inside Google’s AI‑Phishing Lawsuit

For threat intelligence analysts and security operations teams, the Outsider Enterprise takedown offers a rare quantifiable look at an AI‑accelerated phishing operation. The scale—9,000 fake sites in days, a commoditized ‘phishing‑for‑dummies’ kit—redefines the threat landscape for mobile‑first attacks.

Google’s decision to sue an alleged Chinese cybercrime network marks a striking escalation in the fight against AI‑powered fraud. On June 12, 2026, the tech giant filed a complaint against Outsider Enterprise, a foreign‑based group that used artificial intelligence to orchestrate massive SMS phishing campaigns. The operation impersonated Google and other brands, directing victims to fraudulent websites to harvest passwords and credit‑card numbers. Google alleges that the group defrauded “hundreds of thousands of victims,” with losses “estimated in the millions.” Over a mere two‑week observation window, Outsider Enterprise deployed more than 9,000 fake websites, registered one million fraudulent domains, and blasted 2.5 million scam texts exclusively to Android users.

“

It collaborated with telecom incumbents AT&T, T‑Mobile, and Verizon to block the malicious texts and worked alongside the FBI and Lumen’s Black Lotus Labs to seize the operation’s domains and Shopify storefronts.

The scale of the infrastructure is staggering. According to the complaint, the cybercriminals offered a “phishing‑for‑dummies” software suite that let even non‑technical criminals launch convincing scam pages. This turn‑key service commoditized fraud, dramatically lowering the barrier to entry for large‑scale phishing. Google’s response is equally high‑tech: the company claims to intercept over 10 billion scam messages each month using its own AI‑powered detection tools. It collaborated with telecom incumbents AT&T, T‑Mobile, and Verizon to block the malicious texts and worked alongside the FBI and Lumen’s Black Lotus Labs to seize the operation’s domains and Shopify storefronts.

The lawsuit is significant on multiple fronts. Legally, it tests the bounds of American civil litigation against anonymous, foreign defendants whose country may not cooperate. The complaint relies on detailed technical forensics—domain registrations, server logs, and AI‑generated lures—to tie the infrastructure together. For the cybersecurity industry, the case illustrates how criminals have weaponized generative AI to craft convincing smishing messages at unprecedented speed and volume. Google’s counter‑deployment of AI in defense underscores a growing arms‑race dynamic: attackers use AI to mass‑produce and personalize scams, while defenders must deploy real‑time machine learning to detect and neutralize them.