FBI, Google and Lumen Disrupt Outsider Phishing Network Tied to $1.9B in Estimated Losses
Summary
The FBI, Google and Lumen disrupted Outsider in Operation Ghost Hook, seizing servers, domains and about $100,000 in payment wallets. Authorities linked its phishing infrastructure to nearly 3.9 million stolen cards and estimated losses of $1.9 billion.
Key points
- Operation Ghost Hook targeted Outsider, a China-based network that had offered phishing kits and hosted infrastructure since July 2023.
- The FBI and partners seized core servers, domains, a Shopify storefront and about $100,000 from payment wallets; thousands of domains registered through U.S. providers were also seized.
- Authorities traced Outsider phishing domains to nearly 3.9 million stolen credit cards and estimated losses of about $1.9 billion.
- The FBI said the network operated across 55 countries and used a Telegram bot to access information about its customers.
- Google said the kits impersonated trusted brands and could collect credit-card details, bank credentials and personal data, including through SMS, PIN, email and app verification prompts.
- Google said Outsider encouraged customers to use Gemini and other AI platforms to generate phishing lures and websites.
- Google said it was working with AT&T, T-Mobile and Verizon to intercept scam messages; the takedown was part of the FBI’s ongoing Operation Riptide.
Article Details
- Event Type
- Coordinated law-enforcement and industry takedown of the Outsider cybercrime network, including seizure of its core servers, domains, payment wallets, and a storefront.
- Impact
- The FBI said Outsider facilitated phishing attacks across 55 countries. Authorities traced its phishing domains to nearly 3.9 million stolen credit cards; estimated losses were about $1.9 billion. Google said the phishing kits were used to steal payment-card details, bank-account credentials, and personal data.
MITRE ATT&CK
People
Threat Actors
Vendors
AT&TGoogle said it’s working with AT&T, T-Mobile and Verizon to intercept the spam messages before they reach customers, but these types of phishing attacks are prevalent and have been spreading for years.GoogleThe FBI, Google, and Lumen Technologies disrupted Outsider, a China-based cybercrime network that used phishing kits and hosted infrastructure to fuel attacks across 55 countries.Lumen TechnologiesThe FBI, Google, and Lumen Technologies disrupted Outsider, a China-based cybercrime network that used phishing kits and hosted infrastructure to fuel attacks across 55 countries.T-MobileGoogle said it’s working with AT&T, T-Mobile and Verizon to intercept the spam messages before they reach customers, but these types of phishing attacks are prevalent and have been spreading for years.VerizonGoogle said it’s working with AT&T, T-Mobile and Verizon to intercept the spam messages before they reach customers, but these types of phishing attacks are prevalent and have been spreading for years.
Products
Geminigroup behind the operation encouraged and provided step-by-step instructions for customers to use Gemini and other AI platforms to generate custom code for phishing lures and corresponding sites forShopifyAuthorities seized domains, payment wallets, a Shopify storefront, and access via a Telegram bot.TelegramAuthorities seized domains, payment wallets, a Shopify storefront, and access via a Telegram bot.
Countries
ChinaThe FBI, Google, and Lumen Technologies disrupted Outsider, a China-based cybercrime network that used phishing kits and hosted infrastructure to fuel attacks across 55 countries.United Statesfacilitated a wave of phishing attacks against people and businesses in 55 countries, including the United States, the FBI said in a LinkedIn post.