Google Sues Cybercriminal Group Behind Massive Smishing Operation

Google filed a lawsuit yesterday against a foreign cybercriminal group responsible for a widespread SMS phishing, or “smishing,” operation that has impacted over a million victims in 120 countries.

The organization, largely based in China and referred to by some researchers as the “Smishing Triad,” utilizes a phishing-as-a-service kit called “Lighthouse” to create and deploy fraudulent text messages. These texts often impersonate legitimate brands like E-ZPass, the U.S. Postal Service, and even Google itself, luring victims to malicious websites designed to steal sensitive financial information. Google estimates the group has stolen between 12.7 million and 115 million credit cards in the U.S. alone, highlighting the growing threat of financial fraud through mobile devices.

Google is pursuing claims under the Racketeer Influenced and Corrupt Organizations (RICO) Act, the Lanham Act, and the Computer Fraud and Abuse (CFAA) Act, seeking to dismantle the group and the “Lighthouse” platform. “They were preying on users’ trust in reputable brands…The ‘Lighthouse’ enterprise or software creates a bunch of templates in which you create fake websites to pull users’ information,” explained Halimah DeLaine Prado, Google general counsel, in a statement. Investigations revealed a sophisticated network of over 2,500 members coordinating on Telegram, divided into groups responsible for data brokering, spamming, and credential theft. You can learn more about protecting yourself from phishing scams at the Federal Trade Commission’s website.

In addition to the lawsuit, Google is endorsing three bipartisan bills aimed at bolstering fraud and cyberattack protection, including the GUARD Act, the Foreign Robocall Elimination Act, and the Scam Compound Accountability and Mobilization Act. The company has also recently implemented new safety features, such as the Key Verifier tool and AI-powered spam detection in Google Messages. Google officials stated the lawsuit is a critical step in preventing further harm and deterring similar cybercriminal activity.