Loading story…
A large-scale smishing operation sent fraudulent mobile text messages that impersonated toll road operators, package delivery firms, and government agencies, luring victims to mobile-optimized phishing sites built to steal credentials, payment card data, and other sensitive information. Researchers linked the activity to industrialized phishing infrastructure using spoofed brands, dynamically generated subdomains, low-cost .top and .cc domains, Let's Encrypt certificates, geo-fencing, and cloud-hosted servers, with campaigns targeting services in the UAE, Singapore, and other regions including transportation, logistics, and public-sector brands such as Emirates Post, Salik, Parkin, Dubai Police, Aramex, and Singapore's Land Transport Authority.
Google said it filed a lawsuit against a China-linked scam network known as Outsider Enterprise, alleging the group abused Gemini to help create phishing content and fake websites impersonating brands including Google, YouTube, and New York E-ZPass. According to the filing, the operation marketed phishing-as-a-service through Telegram with nearly 300 scam templates for customers, while Google coordinated with AT&T, Verizon, and T-Mobile to block malicious texts; the company also said Google Messages scam detection now blocks about 10 billion scam texts each month.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Google said it worked with AT&T, Verizon, and T-Mobile to block many malicious text messages tied to the scam campaigns. It also said Google Messages scam detection blocks about 10 billion scam texts per month.
Google filed a lawsuit against a China-linked scam operation identified as Outsider Enterprise, alleging it abused Gemini to support phishing campaigns. According to the filing, the group used Telegram and sold phishing-as-a-service offerings with nearly 300 scam templates, including fake Google, YouTube, and New York E-ZPass sites.
Zimperium published details of a large-scale smishing campaign that sent fraudulent toll, package delivery, and government-themed text messages to mobile users. The messages redirected victims to phishing sites built to steal credentials, payment card data, and other sensitive information.
A research report described a large-scale smishing and phishing infrastructure targeting transportation, government, and logistics brands in the UAE and Singapore. The operation used spoofed brands, dynamic subdomains, Alibaba Cloud-hosted infrastructure, geo-fenced mobile phishing pages, and indicators including emiratespost.ae.tcsz.top and 47.254.56.221.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
schneier.com
Open sourcezimperium.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google filed a lawsuit in the U.S. District Court for the Southern District of New York against **Outsider Enterprise**, an alleged China-based cybercrime network accused of abusing **Gemini** and other AI tools to build phishing websites and support large-scale smishing campaigns targeting U.S. consumers. Google said the Telegram-based operation functioned as a phishing-as-a-service platform, offering more than 290 prebuilt templates and infrastructure used to impersonate brands and institutions including Google, YouTube, USPS, banks, DMVs, mobile carriers, and E-ZPass in order to steal credentials and payment information. According to Google, the campaign was tied to more than **9,000** fake websites, over **1 million** fraudulent URLs, and roughly **2.5 million** smishing messages sent to Android users during a two-week period in May, while users reported at least **55,000** related spam texts and losses reached millions of dollars across hundreds of thousands of victims. The company said it has disabled abusive accounts and infrastructure, is coordinating disruption efforts with the **FBI Cyber Division** and major U.S. carriers including **AT&T, T-Mobile, and Verizon**, and is pursuing claims under `RICO` and the `Lanham Act` as part of a broader effort to curb AI-enabled scam operations.
Jul 12, 2026
Google has filed a civil lawsuit in the US Southern District of New York against 25 individuals alleged to be behind a large-scale phishing-as-a-service operation known as Lighthouse. The company accuses a Chinese cybercriminal group of selling "phishing for dummies" kits that enable even inexperienced fraudsters to launch widespread SMS and e-commerce scams. These kits provide hundreds of templates for fake websites, domain setup tools, and other resources, allowing attackers to impersonate well-known brands, government agencies such as USPS, and toll collection firms, tricking victims into disclosing sensitive information like passwords and financial details. The Lighthouse network, also referred to as part of the "Smishing Triad," is accused of targeting millions of people in over 120 countries, including a significant number of Americans. Google alleges that the group has generated over a billion dollars through these scams and has abused Google's logos and technology to increase the credibility of their fraudulent sites. The lawsuit represents one of the most high-profile legal actions against transnational smishing operations, highlighting the growing threat posed by organized cybercrime groups leveraging phishing-as-a-service platforms.
Jun 29, 2026
Infoblox researchers reported a long-running **International Revenue Share Fraud (IRSF)** campaign that uses fake CAPTCHA pages to trick mobile users into sending premium-rate international text messages. Victims are funneled through typosquatted telecom-themed domains, ad-network redirects, and **Traffic Distribution System (TDS)** infrastructure to scam landing pages that present bogus verification steps. Those prompts trigger JavaScript that opens the phone’s SMS app with pre-filled messages and dozens of international numbers, and a single four-step interaction can generate about **60 SMS messages to more than 50 destinations**, costing roughly **$30 or more** per session. Researchers said the operation has been active since at least 2020, uses high-fee destinations including **Azerbaijan, Egypt, and Myanmar**, and has been linked to an affiliate of a European **Click2SMS** network using infrastructure hosted on **AS15699, Adam Ecotech**. Separately, Toronto police arrested three men in what authorities described as Canada’s first criminal case involving a mobile **SMS blaster**, a rogue device that impersonates a cellular tower to push phishing texts and disrupt legitimate service. Investigators said the devices were tracked across the Greater Toronto Area after one was detected in downtown Toronto, and police seized multiple SMS blasters and related equipment. Authorities believe **tens of thousands of phones** connected to the rogue system, contributing to more than **13 million network disruptions** that may have interfered with normal mobile access and even emergency services such as **911**. The cases highlight how attackers are abusing both web lures and fake base-station hardware to scale **smishing** and mobile billing fraud.
Jun 29, 2026