Google Disrupts Gemini-Abusing Phishing Service and Details AI Defenses

Google said it disrupted Outsider Enterprise, a China-based cybercrime service supplying phishing kits for mass impersonation of Google and other trusted brands, after operators used Gemini to generate code and scale campaigns. The June 2026 disruption marked Google's first legal action over Gemini misuse. In its adversarial AI threat report, Google described account and project suspensions, model safeguards, threat monitoring, and red teaming as complementary measures against AI-enabled abuse.

Google also reported deploying real-time defenses against model extraction, or distillation, intended to detect attempts to clone proprietary model logic and degrade unauthorized student models. For enterprise customers, it described Google AI Threat Defense as an autonomous architecture combining Gemini and other frontier models, Wiz risk prioritization, Gemini and CodeMender remediation, and Mandiant intelligence. The architecture uses lighter models for continuous scanning and specialized frontier models for high-risk vulnerabilities, positioning AI misuse prevention and automated vulnerability response as parallel defensive priorities.