Google filed a federal lawsuit Friday against a Chinese cybercrime network operating a phishing-as-a-service platform called Outsider. The network allegedly weaponized Google's Gemini AI to automate smishing campaigns targeting American victims.
The defendants used Gemini to generate and refine phishing text messages at scale, leveraging the AI's natural language capabilities to craft convincing lures. Outsider functions as a managed service, selling phishing infrastructure and expertise to lower-level threat actors. This model democratizes SMS-based phishing, allowing operators with minimal technical skill to launch campaigns against consumer and enterprise targets.
Google's legal action represents a direct response to threat actors abusing its own generative AI platform for criminal purposes. The tech company took steps to disable the accounts and infrastructure involved, but the lawsuit signals willingness to pursue civil remedies against organized cybercrime operations.
Smishing remains a persistent attack vector because SMS messages bypass email filtering and reach users directly on mobile devices where trust thresholds differ. Adding AI-driven message generation increases success rates by personalizing lures and evading keyword-based detection systems. Defenders face a widening gap as threat actors integrate LLMs into existing attack workflows.
For organizations, this incident underscores several risks. First, enterprise users remain targets for smishing campaigns designed to harvest credentials or deliver malware. Second, generative AI systems, even with abuse detection, can be repurposed by determined attackers. Third, the PhaaS model concentrates attack capabilities, making platforms like Outsider high-value targets for law enforcement and civil litigation.
The lawsuit likely aims to establish legal precedent and disrupt the Outsider operation's economics. However, the underlying technical problem persists. As long as SMS delivery networks operate and AI models generate human-like text, phishing-as-a-service operations will adapt tactics. Organizations