phishing-campaign-intelligenceidentity-impersonation-fraudcybercrime-service-ecosystemai-enabled-threat-activity

AI-Assisted Smishing Operation Impersonates Toll, Delivery, and Government Services

Social Engineering & Fraud · 3 sources · Updated 4mo ago · First seen Jul 6, 2026

A large-scale smishing operation sent fraudulent mobile text messages that impersonated toll road operators, package delivery firms, and government agencies, luring victims to mobile-optimized phishing sites built to steal credentials, payment card data, and other sensitive information. Researchers linked the activity to industrialized phishing infrastructure using spoofed brands, dynamically generated subdomains, low-cost .top and .cc domains, Let's Encrypt certificates, geo-fencing, and cloud-hosted servers, with campaigns targeting services in the UAE, Singapore, and other regions including transportation, logistics, and public-sector brands such as Emirates Post, Salik, Parkin, Dubai Police, Aramex, and Singapore's Land Transport Authority.

Google said it filed a lawsuit against a China-linked scam network known as Outsider Enterprise, alleging the group abused Gemini to help create phishing content and fake websites impersonating brands including Google, YouTube, and New York E-ZPass. According to the filing, the operation marketed phishing-as-a-service through Telegram with nearly 300 scam templates for customers, while Google coordinated with AT&T, Verizon, and T-Mobile to block malicious texts; the company also said Google Messages scam detection now blocks about 10 billion scam texts each month.

Is your org in this campaign?Get the infrastructure and lures behind it.

Hunt this campaign

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · May 10, 2026 – Jul 7, 2026

Jul 7, 20264mo ago
Google coordinates with carriers to block scam texts
Google said it worked with AT&T, Verizon, and T-Mobile to block many malicious text messages tied to the scam campaigns. It also said Google Messages scam detection blocks about 10 billion scam texts per month.
Google Is Suing Chinese Scammers Who Are Using Gemini - Schneier on Security
Jul 7, 20264mo ago
Google sues China-linked scam operation over Gemini abuse
Google filed a lawsuit against a China-linked scam operation identified as Outsider Enterprise, alleging it abused Gemini to support phishing campaigns. According to the filing, the group used Telegram and sold phishing-as-a-service offerings with nearly 300 scam templates, including fake Google, YouTube, and New York E-ZPass sites.
Google Is Suing Chinese Scammers Who Are Using Gemini - Schneier on Security
Jul 6, 20264mo ago
Zimperium reports massive AI-assisted smishing campaign
Zimperium published details of a large-scale smishing campaign that sent fraudulent toll, package delivery, and government-themed text messages to mobile users. The messages redirected victims to phishing sites built to steal credentials, payment card data, and other sensitive information.
Massive Smishing Campaign Abuses Gemini AI to Target Mobile Users with Fake Toll and Delivery Texts
May 10, 20266mo ago
Research documents smishing infrastructure targeting UAE and Singapore
A research report described a large-scale smishing and phishing infrastructure targeting transportation, government, and logistics brands in the UAE and Singapore. The operation used spoofed brands, dynamic subdomains, Alibaba Cloud-hosted infrastructure, geo-fenced mobile phishing pages, and indicators including emiratespost.ae.tcsz.top and 47.254.56.221.
Industrialized Smishing Infrastructure Targeting the UAE and Singapore Transportation, Government, and Logistics Sectors | by BeGoodToAll | May, 2026 | Medium

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

2 linked

Smishing Triad Outsider Enterprise

Organizations

5 linked

GoogleEmirates PostSalikParkinAramex

Observables

8 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.

Hunt This Campaign

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Schneier On SecurityNews · Jul 7, 2026

Google Is Suing Chinese Scammers Who Are Using Gemini - Schneier on SecurityOpen source ↗

Zimperium BlogNews · Jul 6, 2026

Massive Smishing Campaign Abuses Gemini AI to Target Mobile Users with Fake Toll and Delivery TextsOpen source ↗

Medium RaghavtiresearchNews · May 10, 2026

Industrialized Smishing Infrastructure Targeting the UAE and Singapore Transportation, Government, and Logistics Sectors | by BeGoodToAll | May, 2026 | MediumOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News