Outsider Enterprise AI-assisted phishing-as-a-service takedown by FBI, Google and Black Lotus Labs
Preliminary Why: 1 report: BleepingComputer · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: action reported, no fix
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity major: test: many third parties affected (Google states hundreds of thousands of users worldwide) and a government body (FBI) is involved in the takedown.
The FBI, working with Google and Black Lotus Labs, dismantled Outsider Enterprise, a phishing-as-a-service operation that used AI and distributed phishing kits to impersonate trusted brands in texts sent through AT&T, T-Mobile and Verizon. Google linked the operation to 9,000 fake websites and more than a million fraudulent URLs, and said it had been active since at least 2023. Authorities estimated losses of $1.9 billion. During the takedown, the FBI and partners seized administration servers, a Shopify storefront, an account used to test the service and around $100,000 USDT from payment wallets. Thousands of phishing domains now redirect to an FBI splash page. Google has filed a civil lawsuit and is coordinating with carriers to block fraudulent messages before they reach subscribers.
What happened
What was done
Risks
Not yet sorted into a risk
Controls
Not yet read for controls. Controls that mitigate the primary risk:
Similar incidents
Evidence
No source states: what went wrong, what it reached or did, when it happened, when it was found, how many records were exposed, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 4 items from the primary sources
What happened, in order
- 2023 Outsider Enterprise has been active since at least 2023.
- May Over a two-week period in May, 2.5 million SMS messages were sent to Android users from the operation's infrastructure.
Not dated in the sources:
- During the technical takedown, the FBI and partners seized servers, a storefront and a test account.
- Thousands of phishing domains were redirected to an FBI splash page.
Show every field, with its source and grade
What happened
Impact
LR-2026-0586 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON