FBI and Google Dismantle Massive China-Based AI Phishing Operation

Federal authorities, in collaboration with Google and Black Lotus Labs, have disrupted Outsider Enterprise, a significant phishing-as-a-service operation based in China. This operation employed artificial intelligence to create convincing fake websites and scam text messages, aimed at stealing sensitive personal information and financial data.

Authorities report that the infrastructure associated with Outsider Enterprise is linked to an estimated 3.87 million stolen credit cards and approximately $1.9 billion in losses. The FBI referred to the technical takedown as Operation Ghost Hook, a component of the broader Operation Riptide initiative targeting cybercrime. The FBI and its partners seized administration servers, phishing domains, a Shopify storefront, and approximately $100,000 in cryptocurrency from wallets tied to the operation.

Google's involvement included a civil lawsuit filed in federal court in New York, alleging that the phishing kits used AI tools, including Google's Gemini, to accelerate the creation of fraudulent sites and scam content. This AI integration allowed for more polished and convincing scams, making it harder for individuals to distinguish them from legitimate communications.

Outsider Enterprise functioned as a criminal software business, offering phishing kits, fake websites, and the necessary infrastructure for other criminals to impersonate trusted brands. Google indicated that the network was linked to over 9,000 fake websites and more than 1 million fraudulent URLs designed to trick users into divulging credit card details, passwords, and other personal information.

During a two-week period in May, Outsider Enterprise infrastructure sent an estimated 2.5 million scam messages to Android users, with 55,000 flagged as fraudulent. The scams often began with text messages appearing to originate from major wireless carriers, delivery services, or toll agencies, leveraging the existing trust users have in these brands for legitimate alerts.

To combat such threats, individuals are advised to exercise caution with unexpected text messages, especially those creating a sense of urgency. Experts recommend not clicking on links in suspicious texts and instead navigating directly to a company's official website or app. Verifying web addresses before entering any information, never sharing one-time passcodes, and enabling spam protection on mobile devices are also key protective measures. Additionally, securing wireless carrier accounts with strong passwords and PINs, using password managers, and enabling two-factor authentication can further safeguard personal data. Reporting scam texts to 7726 and submitting complaints to the FBI's Internet Crime Complaint Center (IC3.gov) are also encouraged steps.