Loading story…
Google has initiated legal action against the operators of Lighthouse, a large-scale Phishing-as-a-Service (PhaaS) platform, by filing a lawsuit in the Southern District of New York. The complaint alleges that Lighthouse provided ready-made phishing kits impersonating major brands such as E-ZPass, USPS, and Google itself, using Google’s trademarks to create convincing sign-in screens. These kits were rented to cybercriminals globally, facilitating the theft of credentials and credit card data from millions of users.
Google’s lawsuit, titled Google LLC v. Does 1–25, No. 1:25-cv-09421, represents a strategic move to use civil litigation as a complement to criminal investigations, aiming for injunctive relief and discovery even when monetary damages may be unlikely. The legal action is structured similarly to a hacking indictment and racketeering case, signaling a proactive approach by Google to disrupt cybercrime infrastructure and deter future phishing operations targeting its users and brand.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
By 2025-11-19, reporting on Google's complaint described Lighthouse as a 'phishing for dummies' service offering templates, domain setup tools, and licensing for scam campaigns. The kits were allegedly used worldwide in SMS and ad-driven phishing operations that redirected victims to fake toll, delivery, and Google-branded sites to steal credentials, card data, and banking information from millions of users.
On 2025-11-12, Google filed a civil complaint in the U.S. District Court for the Southern District of New York against the operators of the Lighthouse phishing-as-a-service platform. The suit alleges the China-based group sold and rented kits impersonating brands including E-ZPass, USPS, and Google to enable large-scale credential and payment theft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
schneier.com
Open sourcesecurityboulevard.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has filed a civil lawsuit in the US Southern District of New York against 25 individuals alleged to be behind a large-scale phishing-as-a-service operation known as Lighthouse. The company accuses a Chinese cybercriminal group of selling "phishing for dummies" kits that enable even inexperienced fraudsters to launch widespread SMS and e-commerce scams. These kits provide hundreds of templates for fake websites, domain setup tools, and other resources, allowing attackers to impersonate well-known brands, government agencies such as USPS, and toll collection firms, tricking victims into disclosing sensitive information like passwords and financial details. The Lighthouse network, also referred to as part of the "Smishing Triad," is accused of targeting millions of people in over 120 countries, including a significant number of Americans. Google alleges that the group has generated over a billion dollars through these scams and has abused Google's logos and technology to increase the credibility of their fraudulent sites. The lawsuit represents one of the most high-profile legal actions against transnational smishing operations, highlighting the growing threat posed by organized cybercrime groups leveraging phishing-as-a-service platforms.
Jun 29, 2026
Google filed a lawsuit in the U.S. District Court for the Southern District of New York against **Outsider Enterprise**, an alleged China-based cybercrime network accused of abusing **Gemini** and other AI tools to build phishing websites and support large-scale smishing campaigns targeting U.S. consumers. Google said the Telegram-based operation functioned as a phishing-as-a-service platform, offering more than 290 prebuilt templates and infrastructure used to impersonate brands and institutions including Google, YouTube, USPS, banks, DMVs, mobile carriers, and E-ZPass in order to steal credentials and payment information. According to Google, the campaign was tied to more than **9,000** fake websites, over **1 million** fraudulent URLs, and roughly **2.5 million** smishing messages sent to Android users during a two-week period in May, while users reported at least **55,000** related spam texts and losses reached millions of dollars across hundreds of thousands of victims. The company said it has disabled abusive accounts and infrastructure, is coordinating disruption efforts with the **FBI Cyber Division** and major U.S. carriers including **AT&T, T-Mobile, and Verizon**, and is pursuing claims under `RICO` and the `Lanham Act` as part of a broader effort to curb AI-enabled scam operations.
Jul 12, 2026
A large-scale smishing operation sent fraudulent mobile text messages that impersonated toll road operators, package delivery firms, and government agencies, luring victims to mobile-optimized phishing sites built to steal credentials, payment card data, and other sensitive information. Researchers linked the activity to industrialized phishing infrastructure using spoofed brands, dynamically generated subdomains, low-cost `.top` and `.cc` domains, Let's Encrypt certificates, geo-fencing, and cloud-hosted servers, with campaigns targeting services in the UAE, Singapore, and other regions including transportation, logistics, and public-sector brands such as Emirates Post, Salik, Parkin, Dubai Police, Aramex, and Singapore's Land Transport Authority. Google said it filed a lawsuit against a China-linked scam network known as **Outsider Enterprise**, alleging the group abused **Gemini** to help create phishing content and fake websites impersonating brands including Google, YouTube, and **New York E-ZPass**. According to the filing, the operation marketed phishing-as-a-service through Telegram with nearly 300 scam templates for customers, while Google coordinated with **AT&T**, **Verizon**, and **T-Mobile** to block malicious texts; the company also said Google Messages scam detection now blocks about **10 billion** scam texts each month.
Jul 7, 2026