Chinese cybercrime operation that used AI to scam ‘hundreds of thousands of victims’ sued by Google

In a significant legal move, Google has initiated a lawsuit aimed at dismantling a vast cybercrime operation that reportedly employs artificial intelligence to perpetrate scams. Announced on Friday, the lawsuit targets a group known as Outsider Enterprise, which is accused of using AI to send fraudulent text messages that impersonate Google and other reputable brands, all in an effort to steal sensitive information such as passwords and credit card details. According to Google, this cybercrime network has defrauded 'hundreds of thousands of victims,' with financial losses estimated to be in the millions. The operation is said to have launched 9,000 fake websites and sent over 2.5 million scam texts to Android users in just a two-week window. In May alone, Android users flagged approximately 55,000 spam texts, translating to more than two complaints per minute. To combat this rising threat, Google has been utilizing its own AI-powered tools designed to detect and alert users about potential scams. This proactive approach has led to the interception of more than 10 billion scam messages each month. Google has also partnered with major telecom operators like AT&T, T-Mobile, and Verizon to block these deceitful text messages and is working closely with the FBI. An FBI spokesperson reported that, in collaboration with Google and Lumen’s Black Lotus Labs, several domains associated with the cybercriminals have been seized. Since July 2023, the Outsider Enterprise has allegedly facilitated the theft of around 3.87 million credit cards, resulting in approximately $1.9 billion in financial losses. The lawsuit outlines the evidence gathered against the individuals behind Outsider Enterprise, who remain anonymous and are believed to operate from overseas. Google described the group as having developed an easily accessible online software suite that allows even those with minimal technical skills to create fraudulent websites aimed at stealing from victims. This phishing software, dubbed Outsider, is available for purchase at $88 per week or $200 per month, enabling users to generate fake websites using AI technologies, including Google’s own Gemini. By sending out malicious text messages or purchasing ads, the fraudsters lure victims to these counterfeit sites. The ultimate goal is to capture passwords and multi-factor authentication codes, which are then transmitted in real-time through Outsider’s platform. Google emphasized that the Outsider software is particularly attractive due to its user-friendliness, allowing individuals with limited technical knowledge to engage in various phishing schemes and collaborate with other members through platforms like Telegram. The cybercriminals coordinate openly, sharing strategies and developing their phishing attacks. The Outsider platform reportedly offers over 290 ready-made templates that closely mimic legitimate websites, making it easy for criminals to create convincing replicas in a matter of minutes. Furthermore, it provides resources on how to leverage AI-generated code for malicious purposes, and a dashboard to monitor the success of phishing campaigns. Google's complaint cites that the cybercriminals have utilized Google Drive and Cloud services to host their phishing websites. The scale of Outsider Enterprise’s operations is alarming, with Google detecting more than 1.59 million URLs linked to the group over a five-month period. The lawsuit accuses the members of Outsider Enterprise of impersonating Google, copyright infringement, racketeering, wire fraud, and misleading advertising. Google is seeking both compensatory and punitive damages, alongside a court order to halt the criminal activities of this organization.