Google Lawsuit Against Lighthouse Phishing-as-a-Service Platform

Google has initiated legal action against the operators of Lighthouse, a large-scale Phishing-as-a-Service (PhaaS) platform, by filing a lawsuit in the Southern District of New York. The complaint alleges that Lighthouse provided ready-made phishing kits impersonating major brands such as E-ZPass, USPS, and Google itself, using Google’s trademarks to create convincing sign-in screens. These kits were rented to cybercriminals globally, facilitating the theft of credentials and credit card data from millions of users.

Google’s lawsuit, titled Google LLC v. Does 1–25, No. 1:25-cv-09421, represents a strategic move to use civil litigation as a complement to criminal investigations, aiming for injunctive relief and discovery even when monetary damages may be unlikely. The legal action is structured similarly to a hacking indictment and racketeering case, signaling a proactive approach by Google to disrupt cybercrime infrastructure and deter future phishing operations targeting its users and brand.