Google has filed a civil lawsuit in the US against an alleged China‑based cybercrime operation dubbed “Outsider Enterprise,” accusing it of running AI‑accelerated smishing campaigns at global scale. Court filings say the group used automated tools to generate and blast out roughly 2.5 million fraudulent text messages over two weeks, spoofing banks, parcel firms and tech platforms to harvest credentials and payment details. Google claims the attackers leaned on generative AI to create more convincing, localised lures in multiple languages, and to iterate message variants fast enough to evade traditional spam filters.
For CISOs and security architects, the case is an early, public test of how big tech plans to respond when AI becomes a force‑multiplier for low‑skill fraud. Beyond technical takedowns and threat‑intel sharing, Google is turning to the courts to seek injunctions that would block Outsider Enterprise from registering new Google accounts, domains and services under any identity. That signals a shift towards treating persistent threat actors more like repeat civil offenders in the platform economy, not just IP addresses to be blocked.
Enterprises can read this as a preview of the next phishing wave: highly personalised, AI‑generated smishing and email campaigns that look and feel like legitimate customer communications. It raises the bar for user education, mobile threat defence and payment‑fraud analytics, and strengthens the argument for hardware‑backed authentication instead of one‑time codes delivered over SMS.
