In the US, the FBI, Google, and Black Lotus Labs announced the takedown of a major phishing network that used fake websites and phishing messages. The network targeted credit card numbers, passwords, and other personal data.
According to officials, the structure is described as a phishing-as-a-service scheme known as Outsider Enterprise. In this model, fraudsters can carry out attacks by renting ready-made phishing kits and services instead of building their own infrastructure.
Linked to thousands of fake sites
Google reported that the network was connected to more than 9,000 fake websites and over 1 million fraudulent URLs. These sites tried to steal information by directing users to payment and login screens that appeared genuine.
Most attacks were launched via text messages. The messages prompted users to click on a link by appearing to come from major mobile carriers, delivery companies, or toll agencies.
AI claim reflected in court filing
In a civil lawsuit filed by Google in federal court in New York, it was alleged that the phishing kit used artificial intelligence tools, including Gemini, to produce fake content. This claim may have led to messages and websites looking more polished and realistic.
This made it harder to spot risks based on classic fraud indicators. Instead of poorly written messages or obvious language errors, normal-looking warnings and urgent payment requests came to the fore.
Millions of messages in two weeks
According to Google, 2.5 million messages were sent to Android users from the Outsider Enterprise infrastructure over a two-week period in May. Users flagged 55,000 of them as fraud.
FBI Cyber Division Deputy Director Brett Leatherman said the structure is linked to an estimated 3.87 million stolen credit cards and $1.9 billion in losses.
Servers and domain names seized
The FBI announced that the technical intervention was conducted under the name Operation Ghost Hook. Leatherman also stated that work was carried out as part of Operation Riptide, which targets larger-scale cybercrime networks.
Officials reported that management servers, phishing domain names, a Shopify store, and approximately $100,000 in a payment wallet belonging to the operation were seized.
Companies take filtering measures
Google said it worked with AT&T, T-Mobile, and Verizon to help block fraudulent messages before they reached subscribers. The company also noted that Android protections help detect suspicious calls and block harmful messages.
Experts warn, however, that no filter can stop all attacks. Fraudsters try to make the message appear like an ordinary notification and get the user to act within seconds.
Basic security steps for users
Experts advise not to tap on links in unexpected messages, and to directly go to the official app or website. They emphasize that a few seconds of pause is important, especially for messages that create a sense of urgency.
Users should check the web address carefully, not share one-time codes, and not enter payment or login information via message links. Other recommendations include enabling spam protection on phones, adding a strong password and PIN to carrier accounts, and using two-factor authentication.
Suspicious messages can be reported by forwarding them to 7726, and complaints can be made to the relevant companies and the FBI’s Internet Crime Complaint Center.
