Google takes an AI phishing ring to court

We have all received them: the fake parcel alerts, urgent bank warnings, and panicked notifications claiming your account has been compromised. But thanks to generative AI, these scam messages no longer look like obvious, poorly translated spam—they look identical to real customer service alerts.

Now, Google is taking aggressive steps to dismantle the network behind the flood. The company has filed a federal civil lawsuit targeting a major cybercrime syndicate dubbed the "Outsider Enterprise," coordinating with law enforcement and telecoms to pull the plug on their infrastructure.

Millions of texts coordinated over Telegram

According to Google, the Outsider Enterprise is an organized cybercrime operation based in China that coordinates primarily through Telegram. The network packages and sells turnkey "phishing kits" that allow downstream criminals to impersonate Google and other trusted brands at scale.

The sheer scale of the operation is staggering. Investigators tracked 9,000 fake websites and over 1 million fraudulent URLs tied directly to the group. Their primary goal is simple: harvest credentials and credit card numbers from unsuspecting victims.

During just two weeks this past May, the group blasted 2.5 million malicious text messages containing Outsider-generated links to Android devices. Android users flagged 55,000 scam texts during those fourteen days alone, averaging more than two spam complaints every single minute. Google notes that hundreds of thousands of victims have already lost millions of dollars.

Teaming up with carriers and the FBI

Recognizing that playing whack-a-mole on the operating system level is not enough, Google is assembling a broad coalition.

On the telecommunications front, Google is coordinating directly with AT&T, T-Mobile, and Verizon to choke off scam traffic at the network level before it ever hits handsets. AT&T and Verizon confirmed they are using their own AI tooling and the Industry Traceback Group to hunt scam links back to their origins.

On the law enforcement side, the FBI Cyber Division is stepping in with enforcement actions alongside Google's civil suit. Meanwhile, Google says Android's built-in defenses already intercept over 10 billion malicious messages every month.

Google is also using this moment to flex its lobbying muscle in Washington, formally endorsing seven bipartisan federal bills, including the National Strategy for Combating Scams Act and the Stop SCAMS Act, aimed at setting up permanent federal anti-scam frameworks.

Why it matters

We think this lawsuit highlights a massive shift in how the tech industry has to handle security in the generative AI era.

For everyday smartphone users, the takeaway is sobering: personal vigilance is no longer enough. When AI can craft flawless, personalized smishing campaigns at zero marginal cost, relying on human instinct to spot spelling errors is dead. Protections have to be invisible and handled upstream.

Google's strategy here is clever because it attacks the problem from multiple layers simultaneously—suing to seize domains, partnering with carriers to block routes, and pushing federal legislation to streamline government cooperation. Taking out the infrastructure hurts criminal ROI far more than tweaking a client-side spam filter.

That said, significant hurdles remain. Transnational crime rings operating abroad are notoriously hard to bring to justice in US courts. Seizing 9,000 domains is a massive victory, but as long as anonymous chat apps like Telegram keep facilitating phishing-as-a-service, new operations will inevitably pop up to take their place.