FBI dismantles China-based phishing operation that stole $1.9 billion from victims

A massive China-based cybercrime network has been dismantled following a coordinated effort by the FBI, Google, and Black Lotus Labs. The operation, known as Outsider Enterprise, functioned as a phishing-as-a-service platform that enabled criminals worldwide to launch sophisticated digital attacks. Authorities estimate the network facilitated the theft of 3.87 million credit card numbers and caused $1.9 billion in losses. The takedown, dubbed Operation Ghost Hook, represents one of the most significant actions against organized cybercrime infrastructure in recent years.

The criminal enterprise operated differently from traditional solo scammers. Instead of individual hackers building fake websites from scratch, Outsider Enterprise sold complete phishing kits to other criminals. These kits included fake websites, infrastructure tools, and resources designed to impersonate trusted brands. The service model transformed cybercrime into a scalable business, allowing even low-skill criminals to launch professional-looking attacks. Federal authorities seized administration servers, phishing domains, a Shopify storefront, and approximately $100,000 from payment wallets connected to the operation.

Artificial intelligence accelerated fraud creation and distribution

The operation incorporated artificial intelligence tools to enhance speed and sophistication. According to a civil lawsuit filed by Google in federal court in New York, the phishing kit used AI technology, including Gemini, to help criminals create fraudulent sites and scam content rapidly. This technological advancement eliminated many traditional red flags that users once relied upon to identify scams. Messages appeared cleaner, websites looked more convincing, and operations moved faster than ever before. The polish achieved through AI assistance made it significantly harder for average users to distinguish legitimate communications from fraudulent ones.

Google reported that the network was connected to more than 9,000 fake websites and over 1 million fraudulent URLs. These sites were designed to mimic legitimate companies closely enough to trick users into entering credit card details, passwords, and other sensitive information. The scale of the operation was staggering. During a two-week period in May alone, 2.5 million messages were sent to Android users from Outsider Enterprise infrastructure. Android users flagged 55,000 of those messages as fraudulent, revealing only a fraction of the total volume of scam attempts.

Text messages served as primary entry point for attacks

The scams typically began with text messages appearing to come from wireless carriers, delivery services, toll agencies, or other familiar companies. These messages often arrived during moments when users were distracted or rushed, increasing the likelihood of impulsive clicks. A typical scam text might claim a delivery failed, a phone bill had an issue, or an account would be locked unless immediate action was taken. The link then directed victims to pages designed to harvest login credentials, credit card numbers, or one-time authentication codes.

What made these attacks particularly dangerous was their integration into normal messaging flows. The fraudulent texts arrived in the same place users received legitimate alerts from banks, delivery services, and phone providers. The urgency built into the messages exploited natural human responses to potential problems. Criminals counted on split-second panic reactions, betting that users would act before taking time to verify the message’s authenticity. The entire scheme depended on speed, with less thinking time translating to higher success rates for the scammers.

Law enforcement response combined technical and legal strategies

Brett Leatherman, FBI Cyber Division Assistant Director, confirmed that Outsider infrastructure was tied to Operation Riptide, a broader FBI campaign targeting cybercrime operations. The multi-pronged approach involved not only technical takedowns but also legal action designed to disrupt the business model supporting the criminal network. Google’s civil lawsuit formed part of this broader strategy to dismantle the infrastructure enabling mass phishing attacks.

The technology companies involved are working to strengthen defenses against similar operations. Google stated it is collaborating with AT&T, T-Mobile, and Verizon to block fraudulent messages before they reach subscribers. Android protections have been enhanced to detect suspicious calls and block malicious messages. However, authorities acknowledge that no filter system catches every attack. The evolving nature of cybercrime means criminals continuously adapt their methods to bypass security measures.

Users can protect themselves through simple verification habits

Security experts recommend treating unexpected links as warning signs, even when messages appear official. The safest approach involves going directly to a company’s app or website by typing the address manually or using saved bookmarks. Real companies typically provide more than a few minutes to resolve issues, so any message demanding immediate action should trigger skepticism. Users should examine domain names carefully before entering passwords, card numbers, or codes, watching for extra words, strange endings, or spelling variations.

• Never send back one-time codes via text message, as legitimate companies will not request this action.
• If a text requests credit card numbers, passwords, or account logins, open the official app or call the company using a number from your card or bill.
• Enable spam protection features on your device to filter suspicious messages before they reach your main inbox.
• On iPhone, navigate to Settings, then Apps, then Messages, then Unknown Senders, and activate Screen Unknown Senders.
• On Samsung devices using Google Messages, open the app, tap your profile icon, and enable spam filtering options.

Criminal infrastructure continues evolving despite major takedowns

The Outsider Enterprise takedown demonstrates both progress and ongoing challenges in combating cybercrime. While authorities successfully disrupted a major criminal network, the phishing-as-a-service model revealed how cybercrime has industrialized. The ease with which criminals could rent tools and infrastructure lowered barriers to entry, enabling more widespread attacks. The incorporation of AI technology accelerated this trend, making professional-looking scams accessible to criminals with minimal technical skills.

The $1.9 billion in estimated losses underscores that these operations are not minor nuisances but organized criminal enterprises causing substantial financial harm. The 3.87 million stolen credit card numbers represent millions of individuals affected by the network’s activities. As technology advances, both law enforcement and technology companies must continuously adapt their strategies. The collaboration between the FBI, Google, Black Lotus Labs, and telecommunications providers illustrates the multi-stakeholder approach required to address modern cyber threats effectively.