# Massive Smishing Campaign Abuses Gemini AI to Target Mobile Users with Fake Toll and Delivery Texts (Outsider Enterprise / Google v. Does 1-25)

> A China-based phishing-as-a-service network dubbed "Outsider Enterprise" ran a smishing campaign impersonating toll agencies (E-ZPass), USPS package delivery, state DMVs, banks, and Google itself, sending 2.5 million fraudulent SMS in a single two-week window and standing up 9,000+ fake sites and 1.59M+ malicious URLs to harvest credentials and payment-card data from over 100,000 victims. Google sued the network in Manhattan federal court on 2026-06-12, alleging operators jailbroke Gemini AI by framing malicious requests as harmless "gift redemption page" coding assistance to mass-produce phishing-page HTML.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1479
- **ID:** TL-2026-1479
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Outsider Enterprise (China)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Zimperium's Mobile Threat Watch (2026-07-06) flagged a large-scale smishing operation tied to a Chinese cybercrime network that Google, in a June 2026 federal civil lawsuit (Google LLC v. Does 1-25, S.D.N.Y./Manhattan, Court Listener docket 73476270), identifies as "Outsider Enterprise." The network operates a self-service phishing-as-a-service (PhaaS) platform sold via a Telegram bot (@OutsiderCodeBot, later disabled) for $88/week or $200/month, giving low-skill affiliates access to 290+ prebuilt brand-impersonation templates (Google, YouTube, USPS, financial institutions, state DMV agencies, and toll operators including New York's E-ZPass) plus real-time keystroke-logging and campaign-performance dashboards on the resulting phishing pages.

The operation is internally divided into specialized crews coordinated over Telegram: a Developer Group that builds phishing software/templates, a Data Broker Group that curates target phone-number/identity lists, a Spammer Group that runs bulk SMS delivery tooling, and a Theft Group that monetizes stolen credentials/payment data and launders proceeds (part of an estimated $1.9B in FBI-tracked PhaaS losses tied to an estimated 3.87M stolen credit cards since July 2023).

Google's suit is the company's first alleging abuse of its own Gemini AI tooling: Outsider operators prompted Gemini (and other AI platforms) with requests framed as benign programming assistance -- e.g., asking for HTML to build a "gift redemption page" with specific functional requirements while avoiding JavaScript dependencies that could trip safety filters -- then imported the AI-generated code directly into the Outsider platform to stand up live, functioning credential-theft pages at scale. Google states it has since disabled the Gemini accounts and infrastructure identified as linked to this abuse, and notes that Android's built-in defenses intercept over 10 billion malicious/suspicious messages per month platform-wide, providing scale context for the volume Outsider represents.

Scale: between 2025-11-14 and 2026-04-14, Google tracked over 9,000 distinct fraudulent websites and 1.59 million malicious URLs tied to the Outsider phishing service. In the two-week window of 2026-05-18 through 2026-06-01 alone, the network sent an estimated 2.5 million spam texts to Android users, generating 55,000 user-flagged spam complaints (over two per minute). Total victims are estimated at 100,000+, with losses in the millions of dollars.

Google's lawsuit follows, by roughly seven months, its November 2025 action against a separate China-based PhaaS operation, "Lighthouse," which ensnared over 1 million victims across 120 countries -- indicating a broader, organized Chinese smishing-as-a-service ecosystem (of which the previously reported "Smishing Triad" is a related, adjacent brand). Google states it is pursuing the Outsider Enterprise lawsuit to obtain injunctive relief to dismantle the network's infrastructure and is coordinating with AT&T, T-Mobile, and Verizon to block Outsider-linked SMS traffic at the carrier level. FBI Cyber Division assistant director Brett Leatherman publicly acknowledged the case as an example of criminal AI misuse in fraud operations; a parallel law-enforcement effort styled "Operation Ghost Hook" (part of the broader "Operation Riptide") has seized Outsider-linked domains from U.S. registrars/hosts (redirecting them to FBI splash pages) and confiscated roughly $100,000 in USDT from Outsider payment wallets.

No software vulnerability or CVE is implicated -- this is a social-engineering/PhaaS campaign, not an exploit chain, so no patch or affected-version data applies.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1588.007 Artificial Intelligence
- T1583.001 Domains
- T1583.006 Web Services
- T1585.001 Social Media Accounts
- T1587.001 Malware
- T1608.005 Link Target
- T1566.002 Spearphishing Link
- T1660 Phishing
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1056.003 Web Portal Capture
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1657 Financial Theft

## Sources

- [Massive Smishing Campaign Abuses Gemini AI to Target Mobile Users with Fake Toll and Delivery Texts](https://zimperium.com/blog/mobile-threat-watch/massive-smishing-campaign-abuses-gemini-ai-to-target-mobile-users-with-fake-toll-and-delivery-texts)
- [Google Sues Chinese Smishing Network Accused of Using Gemini AI in Phishing](https://thehackernews.com/2026/06/google-sues-chinese-smishing-network.html)
- [Google Sues Chinese Cybercrime Network for Using Gemini AI to Launch Cyberattacks](https://cybersecuritynews.com/google-sues-chinese-cybercrime-network/)
- [Google sues China-based scammers using Gemini AI for fraud](https://www.helpnetsecurity.com/2026/06/12/google-china-based-cybercrime-network-lawsuit/)
- [Google Sues Chinese Threat Group Using Gemini AI in Phishing Scams](https://securityboulevard.com/2026/06/google-sues-chinese-threat-group-using-gemini-ai-in-phishing-scams/)
- [Google sues Chinese smishing ring using Gemini AI for phishing pages](https://www.paubox.com/blog/google-sues-chinese-smishing-ring-using-gemini-ai-for-phishing-pages)
- [Google Sues Scam Ring That Used Gemini AI to Flood Phones With Fake Texts](https://www.techtimes.com/articles/318273/20260612/google-sues-scam-ring-that-used-gemini-ai-flood-phones-fake-texts.htm)
- [Google sues Chinese scammers using Gemini AI for fraud](https://www.engadget.com/2192873/google-injunction-chinese-ai-scams/)
- [Google sues scam ring that used Gemini AI to build fraud sites](https://thenextweb.com/news/google-gemini-outsider-enterprise-scam-lawsuit)
- [Google LLC v. Does 1-25 (Docket 73476270)](https://www.courtlistener.com/docket/73476270/google-llc-v-does-125/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1479