Google sues Chinese smishing network for using Gemini AI to power phishing campaigns

Google on Friday filed a lawsuit in Manhattan federal court against a Chinese cybercrime network, accusing it of using the company's Gemini AI agent to generate fraudulent phishing pages and orchestrate large-scale smishing attacks targeting U.S. consumers. The network, referred to as the Outsider Enterprise operates a phishing-as-a-service kit called Outsider, which enabled criminals to send millions of scam text messages impersonating trusted brands like mobile carriers and brokerage firms.

Between November 14, 2025, and April 14, 2026, Google identified more than 1.59 million fraudulent URLs and 9,000 fake websites tied to the service. The operation is estimated to have victimized over 100,000 people, resulting in millions of dollars in losses.

How Gemini was weaponized for phishing

Google's complaint details how the Outsider Enterprise provided step-by-step instructions for members to use AI tools, including Gemini, to generate HTML code for shell websites. The prompts were framed as harmless requests for programming assistance asking the AI to create a gift redemption page with specific functionality while avoiding JavaScript and using inline CSS. The generated code was then copied into Outsider to transform the shell into a fraudulent site designed to steal personal and financial information.

• As little as $88 per week or $200 per month bought a license to use Outsider, purchased via a Telegram bot.
• The kit offered over 290 pre-built templates mimicking legitimate institutions, real-time keystroke logging, and a performance dashboard.
• In a two-week period from May 18 to June 1, 2026, the network sent 2.5 million messages containing links to Outsider-generated websites, with 55,000 spam texts flagged by Android users.
• The FBI estimates the platform accounted for at least 3.87 million stolen credit cards and $1.9 billion in losses between July 2023 and the present.

Industry and law enforcement response

Google is partnering with AT&T, T-Mobile, and Verizon to block scam messages from reaching customers. The FBI, which participated in a joint takedown called Operation Ghost Hook, seized domains, including a Shopify e-commerce storefront, and confiscated approximately $100,000 in USDT from Outsider payment wallets. Thousands of phishing domains were rerouted to an FBI splash page. Brett Leatherman, assistant director of the FBI's Cyber Division, said criminals increasingly use AI to make fraud more convincing and harder to detect. The lawsuit aims to dismantle the network's infrastructure and disrupt its operations. What comes next will depend on the court's actions, but Google and the FBI have signaled continued collaboration to track and prosecute such AI-enabled phishing operations.