Google sues China-based Outsider Enterprise over Gemini AI phishing scheme

Google has sued a China-based phishing network it says used its Gemini AI to build scam infrastructure, part of a coordinated push to dismantle one of the largest AI-powered fraud operations on record. The federal civil complaint, filed June 12, 2026, in the Southern District of New York, names 'Outsider Enterprise,' a phishing-as-a-service operation run through Telegram.

The scale is large. The FBI ties the network to roughly $1.9 billion in losses since July 2023 and traced its phishing domains to nearly 3.9 million stolen credit cards, with victims across 55 countries; the operation sold its toolkit on subscription for as little as $88 a week. Members used Gemini and other AI tools to generate code for phishing websites and supporting infrastructure, Google said in a post detailing the action.

Google linked the group to 9,000 fake websites and more than 1 million fraudulent URLs. In one two-week stretch this past May, Android users flagged 55,000 spam texts tied to the operation, and Google connected 2.5 million messages sent in that period to Outsider-generated websites. The company says it does not know the real names of those behind Outsider, which it describes as supported by multiple cybercrime groups with overlapping infrastructure.

The suit accompanied a coordinated takedown code-named Operation Ghost Hook. The FBI seized core administrative domains, a Shopify storefront, about $100,000 from Outsider payment wallets, and thousands of domains registered through US-based providers. Google said it worked with AT&T, T-Mobile, Verizon, and Lumen Technologies to block the texts, and is pushing for federal legislation to make such protections permanent.

The loss and record-theft figures come from the FBI's estimate, not an independent audit, and the defendants have not answered the complaint. Filing the case anyway signals how AI developers are responding to criminals using their tools. Beyond tuning safety filters, they are taking named operators to court, in concert with law enforcement, to disrupt the infrastructure behind the fraud.