Google has hauled a China-based cybercrime crew into federal court, accusing the group, which it calls the Outsider Enterprise, of turning its Gemini AI system into a full-scale phishing factory. In a civil lawsuit filed Friday, the company says the operation used Gemini to mass-generate phishing websites and pump out millions of fraudulent text messages to Android users, posing as familiar brands and agencies such as Google, YouTube, the U.S. Postal Service and state toll systems. The alleged goal, according to the complaint, was simple and ugly: trick people into handing over passwords, multi-factor authentication codes and payment details as part of what Google describes as industrialized phishing-as-a-service.
In a detailed breakdown on its security blog, Google says the Outsider Enterprise blasted out roughly 2.5 million scam messages to Android users in a two-week stretch in May, which coincided with about 55,000 spam complaints. The company adds that its systems flagged around 9,000 fake websites and more than 1 million fraudulent URLs tied to the operation. Google filed its complaint on June 12, 2026, marking what it frames as a broader effort to tear down the infrastructure behind the scheme.
How the Operation Used AI
According to The Next Web, Google’s lawsuit spells out how Outsider Enterprise members went straight to Gemini for help, explicitly prompting the AI to generate customized code for phishing landing pages. Those pages mimicked gift-redemption offers and account-verification flows, among other lures, and the Outsider platform then converted Gemini’s code into live scam sites. The platform allegedly bundled hundreds of ready-made templates, documentation and a dashboard, making it possible for even nontechnical operators to spin up tailored phishing campaigns at serious scale.
Industry and Law-Enforcement Response
TechCrunch reports that an FBI spokesperson said the bureau, working with Google and outside security researchers, seized several domains and storefronts the group allegedly used to test its phishing service. At the same time, Google says it is teaming up with AT&T, T-Mobile and Verizon to block scam traffic at the carrier level and is leaning on AI-backed detection systems to catch malicious messages before they ever hit users’ phones.
Legal Claims and What Google Wants
In court, Google is throwing the book at the Outsider Enterprise. The complaint accuses the operation of racketeering, wire fraud, trademark infringement, copyright infringement and false advertising, and it asks for injunctive relief alongside damages in order to dismantle the platform. Reporting from MLex and Engadget says Google is seeking court orders that would let it seize or block key infrastructure used to host and publish scam pages and restrict the service’s ability to spin up new phishing sites.
How to Spot and Report Smishing
The U.S. Postal Inspection Service and other federal agencies warn that bogus package-tracking alerts, toll notices and urgent bank messages are among the most common text-based phishing, or smishing, hooks. Their advice is straightforward: do not tap on links in unexpected texts, and never share verification codes or payment information in response to these messages. The Postal Service recommends forwarding suspicious texts to 7726 (SPAM) and filing complaints with the FTC at ReportFraud.FTC.gov so carriers and investigators can trace, block and take down malicious campaigns. The Postal Inspection Service offers additional tips focused on package-style lures.
Why This Case Matters
Security experts say the Outsider Enterprise suit is a stark example of how generative AI can be folded into a criminal supply chain that lowers the barrier to running large-scale fraud. Legal analysts point out that this is an early civil test of how courts and regulators will treat AI-assisted wrongdoing, and that it could influence both future litigation strategies and emerging legislation aimed at automated scam operations.
For now, Google says its immediate goal is to cut off the network’s ability to publish scam pages and shrink the volume of malicious messages that make it to people’s phones. The outcome of the lawsuit, and any follow-on enforcement, is likely to be closely watched as a test case for AI governance and how far major tech companies are expected to go in policing their own tools.
