Your passwords and credit card numbers were never the hard part for scammers. Getting to them at scale was. A Chinese cybercrime network called Outsider Enterprise apparently solved that problem using Google's own Gemini AI.
Google filed a lawsuit in New York against Outsider Enterprise, accusing the group of building a phishing operation so automated and accessible that criminals with zero technical skills could run it. The numbers attached to this case are not small.
Pay less for your games.
Get discounts up to 80% off
What Outsider Enterprise actually built
This was not a handful of hackers throwing together a few convincing fake emails. Outsider Enterprise operated more like a franchised criminal software business. The group created a subscription-based platform, also called Outsider, that starts at $88 per week and hands buyers a ready-made phishing toolkit. Over 290 pre-built website templates are included, each designed to impersonate real companies: banks, wireless carriers, government agencies, retailers, and yes, Google itself.
At least 14 of those templates use Google branding directly, including logos for YouTube, Google Pay, and Google Play. The group used Google Cloud infrastructure to host the fake sites and Google Drive to store stolen data. Brazen does not begin to cover it.
In just a two-week window during May 2026, the operation generated 9,000 fake websites, one million fraudulent web domains, and 2.5 million scam texts sent to Android users. Over five months between November 2025 and April 2026, Google tracked more than 1.59 million URLs tied to Outsider Enterprise activity.
How Gemini got pulled into this
Here's the thing: the AI angle is not incidental. Outsider Enterprise used Gemini to mass-produce phishing content at a speed and volume that would be impossible to sustain manually. The group coordinated through Telegram, sharing tips and trading software kits that plugged Gemini's output directly into scam campaigns across multiple platforms.
The fake sites were convincing enough to extract multiple forms of verification from victims, including SMS codes, PINs, email confirmations, and app-based authentication. That multi-step verification bypass is what let the operation sidestep 3D Secure protections, the layer that normally blocks unauthorized credit card transactions.
The FBI put the total damage in stark terms: since July 2023, Outsider Enterprise's platform enabled the theft of an estimated 3.87 million credit cards and caused roughly $1.9 billion in losses. A previous version of the software alone was linked to at least 36,000 stolen payment cards across 95 countries.
The structure behind the scam
Outsider Enterprise is not a single group. Google's lawsuit describes five distinct sub-groups operating in parallel:
- Developer Group: Builds the phishing software and site templates
- Data Broker Group: Sources victim contact lists from public records, social media, and past data breaches
- Spammer Group: Handles bulk text message infrastructure
- Theft Group: Monetizes stolen data and launders funds
- Telegram Group: Runs the forums that connect all the above and recruits new members
The platform's appeal, as Google's complaint puts it, is that someone with limited technical knowledge can buy in, immediately access other specialists through the Telegram forums, and run a full phishing campaign within minutes of signing up.
The bigger picture for anyone online
This lawsuit lands against a backdrop that the FBI's own data makes uncomfortable to read. US citizens lost $21 billion to cyber fraud last year. Of that, $893.3 million was directly tied to AI-enabled fraud, with 5,879 complaints filed from India alone, making it the second-highest source of reports globally.
AI tools lowering the barrier to entry for scammers is not a new concern, but the Outsider Enterprise case gives it a concrete face. A criminal with no coding background could pay less than $100 a week and immediately start running campaigns that bypass bank-level security. That is the shift this lawsuit documents.
Google's legal action is partly about damages and partly about establishing that misusing its AI products has consequences. The outcome of the New York case will be worth watching, particularly around how courts treat AI providers when their tools are weaponized against users.
For now, the practical reality is that phishing sites are getting harder to spot. If you want to stay sharp on how scams and digital threats intersect with gaming and web3 platforms, the gaming guides section covers security-adjacent topics alongside everything else worth knowing. And if you are spending time in games that blend real money mechanics with gameplay, like the casino crawler that sold 1 million copies in a week, check out the Gamble With Your Friends before you buy guide to understand exactly what you are getting into. Staying informed beats getting caught off guard, whether the threat is in-game or in your inbox.
Google's case against Outsider Enterprise is ongoing. More details from the court filings are expected to surface as the lawsuit progresses through the New York federal system.
