{"schema_version":"0.10.0","id":"LR-2026-0586","record_version":1,"title":"Outsider Enterprise AI-assisted phishing-as-a-service takedown by FBI, Google and Black Lotus Labs","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":42.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.56,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: BleepingComputer · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: BleepingComputer · subject to change"}]},"sources_hash":"bd8e5330610429abd56f01af3b22d51a55238a05399711166655feab0492c0f6"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-14","incident_class":"other","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"The FBI, working with Google and Black Lotus Labs, dismantled Outsider Enterprise, a phishing-as-a-service operation that used AI and distributed phishing kits to impersonate trusted brands in texts sent through AT&T, T-Mobile and Verizon. Google linked the operation to 9,000 fake websites and more than a million fraudulent URLs, and said it had been active since at least 2023. Authorities estimated losses of $1.9 billion. During the takedown, the FBI and partners seized administration servers, a Shopify storefront, an account used to test the service and around $100,000 USDT from payment wallets. Thousands of phishing domains now redirect to an FBI splash page. Google has filed a civil lawsuit and is coordinating with carriers to block fraudulent messages before they reach subscribers.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major test: many third parties affected (Google states hundreds of thousands of users worldwide) and a government body (FBI) is involved in the takedown.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":["credit card data","passwords"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bleepingcomputer.com/news/security/fbi-disrupts-massive-ai-powered-phishing-service-using-a-million-urls/","publisher":"BleepingComputer","date":"2026-06-14","type":"press","title":"FBI disrupts massive AI-powered phishing service using a million URLs - BleepingComputer","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.adversarial_actor":"C","impact.data_categories_exposed":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.adversarial_actor":[{"source_index":0,"quote":"The cybercrime operation used AI and distributed phishing kits for campaigns impersonating various trusted brands in texts sent through AT&T, T-Mobile, and Verizon."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"In a coordinated effort, the FBI, working with Google and Black Lotus Labs, has dismantled a massive Chinese phishing-as-a-service operation called Outsider Enterprise with thousands of phishing websites used to steal credit card data and passwords."}],"event.incident_class":[{"source_index":0,"quote":"The cybercrime operation used AI and distributed phishing kits for campaigns impersonating various trusted brands in texts sent through AT&T, T-Mobile, and Verizon."}],"impact.severity":[{"source_index":0,"quote":"According to Google, the AI-assisted phishing operation has impacted hundreds of thousands of users worldwide."}],"impact.severity_because":[{"source_index":0,"quote":"According to Google, the AI-assisted phishing operation has impacted hundreds of thousands of users worldwide."}],"event.summary":[{"source_index":0,"quote":"In a coordinated effort, the FBI, working with Google and Black Lotus Labs, has dismantled a massive Chinese phishing-as-a-service operation called Outsider Enterprise with thousands of phishing websites used to steal credit card data and passwords."},{"source_index":0,"quote":"The cybercrime operation used AI and distributed phishing kits for campaigns impersonating various trusted brands in texts sent through AT&T, T-Mobile, and Verizon."},{"source_index":0,"quote":"Outsider Enterprise has been active since at least 2023 and operated at a massive scale, with Google linking to it 9,000 fake websites and more than a million fraudulent URLs."},{"source_index":0,"quote":"Authorities believe that phishing campaigns powered by Outsider Enterprise led to stealing more than 3.8 million credit card records, causing an estimated $1.9 billion in losses."},{"source_index":0,"quote":"During the technical takedown, the FBI and partners seized multiple administration servers, a Shopify e-commerce storefront, and an account the threat actor used to test the phishing service."},{"source_index":0,"quote":"The agency also seized around $100,000 USDT from Outsider payment wallets."},{"source_index":0,"quote":"Thousands of phishing domains that the threat actor registered at U.S. providers are now redirecting to an FBI splash page."},{"source_index":0,"quote":"The tech giant has filed a civil lawsuit targeting the operation’s infrastructure, and is coordinating with telecommunications service providers AT&T, T-Mobile, and Verizon to block fraudulent messages before they reach to subscribers."}]},"notes_on_gaps":"No AI model, developer, harness, tools or autonomy were named; the AI was a tool used by criminals, not an autonomous agent, so agent fields, failure classes, controls and root cause are left out. Incident class 'other' is my judgement (criminal misuse of AI, not compromise of an AI system). Event dates: only 'since at least 2023' and 'May' (no year) are stated; no occurrence, disclosure or detection date is given, and the article date is a header not a quoted sentence. Records count was stated only as 'more than 3.8 million', so no integer was written; third-party count was given only as 'hundreds of thousands', so no integer was written. Detection method, trigger, root cause and duration are not stated. Country 'CN' reflects the operator's stated base, not a confirmed incident location. Severity major rests on the stated scale of affected users and FBI involvement. The J9 link is my judgement from the carrier blocking effort and no control was recorded as held or failed for this incident. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: BleepingComputer · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The operation used AI and phishing kits to run text campaigns impersonating trusted brands.","quote":"The cybercrime operation used AI and distributed phishing kits for campaigns impersonating various trusted brands in texts sent through AT&T, T-Mobile, and Verizon.","source_index":0,"grade":"C"},{"step":"caught","text":"The FBI, working with Google and Black Lotus Labs, dismantled the operation.","quote":"In a coordinated effort, the FBI, working with Google and Black Lotus Labs, has dismantled a massive Chinese phishing-as-a-service operation called Outsider Enterprise with thousands of phishing websites used to steal credit card data and passwords.","source_index":0,"grade":"C"},{"step":"done","text":"The FBI and partners seized servers, a storefront and a test account during the technical takedown.","quote":"During the technical takedown, the FBI and partners seized multiple administration servers, a Shopify e-commerce storefront, and an account the threat actor used to test the phishing service.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/fbi-disrupts-massive-ai-powered-phishing-service-using-a-million-urls/"]},"analysis":{"sections":{"timeline":[{"text":"Outsider Enterprise has been active since at least 2023.","quote":"Outsider Enterprise has been active since at least 2023 and operated at a massive scale, with Google linking to it 9,000 fake websites and more than a million fraudulent URLs.","source_index":0,"when":"2023"},{"text":"Over a two-week period in May, 2.5 million SMS messages were sent to Android users from the operation's infrastructure.","quote":"Over a two-week period in May, Google says that a total of 2.5 million SMS messages were sent to Android users from the Outsider Enterprise infrastructure.","source_index":0,"when":"May"},{"text":"During the technical takedown, the FBI and partners seized servers, a storefront and a test account.","quote":"During the technical takedown, the FBI and partners seized multiple administration servers, a Shopify e-commerce storefront, and an account the threat actor used to test the phishing service.","source_index":0,"when":null},{"text":"Thousands of phishing domains were redirected to an FBI splash page.","quote":"Thousands of phishing domains that the threat actor registered at U.S. providers are now redirecting to an FBI splash page.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/fbi-disrupts-massive-ai-powered-phishing-service-using-a-million-urls/"]}}