FBI and Partners Dismantle Outsider Enterprise Phishing Operation
Summary
The FBI, Google and Black Lotus Labs dismantled Outsider Enterprise under Operation Riptide. Authorities attribute more than 3.8 million stolen card records and estimated $1.9 billion in losses to its AI-assisted SMS phishing campaigns.
Key points
- The FBI, Google and Black Lotus Labs dismantled Outsider Enterprise as part of Operation Riptide.
- The operation used AI-assisted phishing kits in SMS campaigns impersonating trusted brands to steal passwords and payment-card data.
- Google linked the operation to 9,000 fake websites and more than one million fraudulent URLs.
- Authorities believe the campaigns resulted in more than 3.8 million stolen credit-card records and an estimated $1.9 billion in losses.
- The takedown seized administration servers, a Shopify storefront, an account used to test the service, about $100,000 in USDT, and a linked Telegram bot.
- Google said 2.5 million messages were sent to Android users from the infrastructure over two weeks in May, and users flagged 55,000 as fraudulent.
Article Details
- Event Type
- Coordinated law-enforcement and industry disruption of a phishing-as-a-service operation, including infrastructure seizures and a civil lawsuit.
- Impact
- Authorities and partners dismantled infrastructure linked by Google to 9,000 fake websites and more than one million fraudulent URLs. Authorities say campaigns led to over 3.8 million stolen credit card records and estimate $1.9 billion in losses. Google reported that 2.5 million SMS messages were sent to Android users over two weeks in May, with 55,000 flagged as fraudulent; Google estimates hundreds of thousands of users were affected.
Threat Actors
Vendors
AT&TThe cybercrime operation used AI and distributed phishing kits for campaigns impersonating various trusted brands in texts sent through AT&T, T-Mobile, and Verizon.GoogleThe FBI, Google, and Black Lotus Labs dismantled Outsider Enterprise, a Chinese phishing-as-a-service operation that used AI and distributed kits to steal credit card data and passwords through massive SMS campaigns.T-MobileThe cybercrime operation used AI and distributed phishing kits for campaigns impersonating various trusted brands in texts sent through AT&T, T-Mobile, and Verizon.Verizon#OutsiderEnterprise
Products
AndroidOver a two-week period in May, Google says that a total of 2.5 million SMS messages were sent to Android users from the Outsider Enterprise infrastructure.ShopifyThe takedown seized servers, wallets, a Shopify storefront, and a Telegram bot linked to the operation.TelegramThe takedown seized servers, wallets, a Shopify storefront, and a Telegram bot linked to the operation.
Countries
ChinaBased in China and coordinating through Telegram, this network distributes “phishing kits” that allow criminals to blast out fake text campaigns that look like they’re from Google and other trusted brands,” Google says.United StatesThousands of phishing domains that the threat actor registered at U.S.