Google sued a China-based cybercrime network Friday for using the company's own Gemini AI to build the infrastructure behind a massive SMS phishing operation, marking the first time the tech giant has legally pursued bad actors for abusing its flagship AI product. The network, which Google calls "Outsider Enterprise," allegedly prompted Gemini to write the code for fake "gift redemption" and brand-impersonation pages, then loaded that code into a phishing platform that pumped out scam texts targeting Americans. The complaint, filed June 12, accuses the group of generating more than 9,000 fake websites and over 1 million fraudulent URLs impersonating Google, YouTube, the U.S. Postal Service, and New York's E-ZPass toll system.
The Wall Street Journal, which first reported the filing, put accused losses at $1.9 billion. The significant detail is not that Gemini produced convincing phishing code. It is that the AI removed the skill barrier entirely.
Building a counterfeit website used to require at least some coding ability. A chatbot lets a low-skill operator generate thousands of custom fake pages on demand, each tweaked to imitate a different brand, turning a manual craft into an assembly line.
During a two-week stretch in May, Android users flagged roughly 55,000 spam texts tied to the campaign. Google connected about 2.5 million messages sent in that same period to Outsider-generated scam sites. The group operated through Telegram, distributing phishing kits for fake package delivery alerts, banking notifications, and account security warnings that directed victims to pages designed to harvest credentials and payment data.
"The operation has affected hundreds of thousands of victims," Google wrote in a post on The Keyword, with losses estimated in the millions. The lawsuit includes screenshots from tutorial videos allegedly circulated inside the operation showing members prompting Gemini to generate the code for fake pages, then importing that code into a phishing platform. Google described the case as its first lawsuit involving abuse of its Gemini AI tools.
Google is coordinating with the FBI, which will take law enforcement actions, and with AT&T, T-Mobile, and Verizon to block the texts at the network level. "Criminals increasingly use AI to make fraud like this more convincing and harder to detect," said Brett Leatherman, assistant director of the FBI's Cyber Division.
The suit targets the group's infrastructure rather than seeking damages alone, the same playbook Google used in November 2025 when it sued the "Lighthouse" network, a "phishing-as-a-service" operation that sold ready-made fake-site templates. Generative AI represents the next escalation: where a kit offered fixed templates, Gemini can produce endless custom variations that help messages slip past filters looking for known patterns.
"Litigation alone won't end this," Google wrote. "So Google is also advocating for federal legislation to make these protections permanent."
Earlier this month, Google introduced new AI-powered scam detection features for Android designed to identify suspicious calls and text conversations. The company said its messaging protections already intercept more than 10 billion malicious messages each month.
