FBI disrupts massive AI-powered phishing service using a million URLs

Key Points:

• The FBI, in collaboration with Google and Black Lotus Labs, dismantled Outsider Enterprise, a large-scale Chinese phishing-as-a-service operation responsible for thousands of phishing websites targeting credit card data and passwords.
• Outsider Enterprise used AI and distributed phishing kits to impersonate trusted brands via text messages sent through AT&T, T-Mobile, and Verizon, resulting in over 3.8 million stolen credit card records and approximately $1.9 billion in losses.
• As part of Operation Riptide, authorities seized multiple servers, a Shopify storefront, a Telegram bot, and around $100,000 in cryptocurrency linked to the operation, while redirecting thousands of phishing domains to an FBI splash page.
• Google filed a civil lawsuit against Outsider Enterprise’s infrastructure and is working with telecom providers to block fraudulent messages, highlighting that 2.5 million scam SMS messages were sent to Android users in a two-week period, with tens of thousands flagged as fraudulent.
• Google advocates for stronger anti-scam legislation, including the Stop SCAMS Act, which would establish a coordinated national strategy led by the FBI to combat AI-enabled fraud, while emphasizing that Android users benefit from AI-powered security defenses.