FBI and Google dismantle China-based 'Outsider' phishing network behind $1.9B in losses
The FBI, Google, and Lumen Technologies have taken down Outsider, a China-based cybercrime network linked to $1.9 billion in losses across 55 countries.
FBI, Google, and Lumen shut down China-based phishing platform tied to $1.9 billion in fraud
The FBI, together with Google and Lumen Technologies, dismantled a major China-based cybercrime network responsible for an estimated $1.9 billion in losses, officials announced Friday, cyberscoop.com reports.
The group, known as Outsider, had been operating since July 2023, offering phishing kits and hosting infrastructure for cybercriminals who carried out attacks against individuals and businesses in 55 countries, including the United States.
The jointly coordinated effort, dubbed "Operation Ghost Hook," resulted in the seizure of several core admin server domains, a Shopify storefront, approximately $100,000 from Outsider's payment wallets, and thousands of domains registered through U.S.-based providers. The FBI also used an Outsider Telegram bot to gather intelligence on the network's customers.
"The criminals behind Outsider Enterprise built a business out of impersonating trusted brands to defraud hundreds of thousands of victims," Brett Leatherman, assistant director of the FBI's cyber division, said in a statement.
Authorities traced Outsider's phishing domains to nearly 3.9 million stolen credit cards.
Outsider sold its phishing kit — which allowed customers to create fraudulent websites and phishing campaigns to harvest credit card numbers, bank credentials, and personal data — for a weekly subscription starting as low as $88. Google, one of the brands impersonated by Outsider's kits, described the operation as a massive AI-powered enterprise in a civil lawsuit filed to dismantle the network's infrastructure.
The China-based group behind Outsider provided step-by-step instructions encouraging customers to use Gemini and other AI platforms to generate custom code for phishing lures. Those lures mimicked missed package notifications, overdue highway tolls, parking violations, brokerage account issues, and wireless carrier rewards programs.
"The Outsider software allows scammers to request multiple types of verification from victims, including SMS, PIN, email and app verification," Google wrote in the lawsuit, filed in the U.S. District Court for the Southern District of New York. "This flexibility enables the enterprise to defeat various forms of authentication security."
Google said it is working with AT&T, T-Mobile, and Verizon to intercept spam messages before they reach customers, and acknowledged that this type of phishing has been spreading for years. General Counsel Halimah DeLaine Prado also called for legislative action in a blog post, backing a series of bills aimed at combating the scams.
"Litigation alone won't end this," Prado wrote. "As threats evolve, our laws must, too."
Google said it does not know the real identities of the individuals or entities behind Outsider, but noted that the operation is supported by multiple cybercrime groups with overlapping infrastructure and distinct roles.
The FBI said the takedown is part of Operation Riptide, an ongoing campaign targeting cybercriminals along with the financial networks and infrastructure they use to commit fraud.
Source: Reuters