Google Sues Alleged Chinese Cybercrime Ring That Used AI to Run $1.9 Billion Phishing Operation

What Google Is Alleging

On Friday, June 12, Google announced a federal lawsuit targeting an alleged cybercrime network it calls Outsider Enterprise, which the company says operates out of China and has been running an AI-assisted phishing-as-a-service business since at least July 2023.

According to Google's complaint, the group deployed 9,000 fake websites, one million fraudulent web domains, and sent 2.5 million scam texts to Android users in a single two-week stretch. Android users flagged 55,000 spam texts in that same two-week period in May alone, which Google described as more than two complaints per minute.

The defendants' real identities are unknown. Google described them as foreign-based operators who built a "phishing-for-dummies" software platform, also called Outsider, that lets low-skill criminals stand up convincing fake websites with AI assistance. Price tag: $88 per week or $200 per month, according to the complaint.

The FBI's Involvement

This is not just a civil lawsuit sitting on a shelf. An FBI spokesperson confirmed to TechCrunch that the bureau, coordinating with Google and Lumen's Black Lotus Labs, has already seized several domains used by Outsider Enterprise, along with Shopify storefronts and accounts the operation used to test its phishing service.

The FBI's involvement elevates this from a corporate legal filing to an active law enforcement action. Domain seizures are a direct hit to operational infrastructure. They don't require identifying or arresting anyone to be disruptive.

Scale of the Alleged Damage

The numbers in the FBI's assessment are significant. Since July 2023, the Outsider platform is alleged to have enabled the theft of an estimated 3,870,000 credit cards with a corresponding estimated $1.9 billion in losses, according to the FBI spokesperson's statement to TechCrunch.

These are estimates, not audited figures. The FBI attributed them to the platform's overall operation, not to any single confirmed transaction. But even discounted for estimation error, the alleged scale puts Outsider Enterprise among the larger cybercrime operations disclosed publicly in recent years.

The fake sites impersonated telecom providers, financial institutions, government agencies, and retailers. Victims were driven there through malicious text messages, often impersonating Google itself.

AI Used Against Its Own Creator

Google's complaint states that Outsider Enterprise used Google's own Gemini AI among other AI platforms to help build its fraudulent websites. Google did not elaborate on how Gemini was being accessed or whether it was through legitimate API accounts, stolen credentials, or workarounds.

Google says it now fights back with its own AI. The company says AI-powered detection tools intercept more than 10 billion scam messages per month and alert users to suspicious calls and texts. It has also been working with AT&T, T-Mobile, and Verizon to block the messages at the carrier level.

The Strongest Counterpoint

Skeptics of Google's framing have a reasonable concern: a company suing over crimes committed partly on its own infrastructure, using its own AI tools, has a storytelling interest in emphasizing its enforcement response over its exposure. Google is simultaneously the victim, the investigator, and the plaintiff here. The complaint's characterization of the group's reach comes largely from Google's own data.

This concern is legitimate. But it doesn't undercut the core facts: domain seizures are public record, the FBI independently confirmed its participation, and phishing-as-a-service networks with accessible pricing tiers are a documented and growing category of cybercrime.

China and the Broader Context

Google did not allege Chinese government involvement. The complaint says the defendants are "foreign-based" and attributed to China on the basis of their operational base, not state sponsorship. That distinction matters. China-based cybercrime ranges from state-directed espionage to independent criminal enterprises with no government connection. Nothing in these sources establishes which category Outsider Enterprise falls into.

The U.S. government has been increasingly willing to name and pursue China-linked cybercriminals through indictments and domain seizures even when arrests are unlikely. The Outsider Enterprise action follows that pattern.

What Comes Next

The lawsuit is civil, which means Google is seeking to dismantle the infrastructure and establish legal liability, not imprison anyone. Since the defendants' identities are unknown and they appear to be overseas, any criminal prosecution would depend on the FBI's ongoing investigation producing identifiable individuals in a jurisdiction where extradition is possible. For China-based defendants, that is a genuine obstacle the current sources leave unresolved.

All factual content in this article is sourced exclusively from TechCrunch's June 12 report by Lorenzo Franceschi-Bicchierai and from the Google complaint and FBI statements cited within it.