Google Sues Alleged Cybercriminal Group Over Widespread SMS Phishing Scams

2025-11-12

The BareStory

Google filed a federal lawsuit on Wednesday against what it described as a criminal organization conducting a large-scale SMS phishing, or "smishing," operation. The legal action, filed in the U.S. District Court for the Southern District of New York, targets a group that Google stated is largely based in China.

The lawsuit alleges the group uses a phishing-as-a-service kit named "Lighthouse" to create and distribute fraudulent text messages. According to Google, these texts impersonate reputable brands, including the U.S. Postal Service and E-ZPass, with messages about unpaid fees or delivery updates. The texts contain links to fake websites designed to steal victims' sensitive financial data, such as banking credentials and Social Security numbers.

According to Google’s general counsel, Halimah DeLaine Prado, the operation has over a million victims in 120 countries. The company claimed the group has stolen between 12.7 million and 115 million credit cards in the U.S. alone. Prado also stated that the organization used a public Telegram channel to recruit and coordinate among its members.

The lawsuit brings claims under the Racketeer Influenced and Corrupt Organizations (RICO) Act. Google said the legal action aims to dismantle the group, its software platform, and deter similar activities. Alongside the lawsuit, the company announced its endorsement of three bipartisan bills intended to combat cybercrime, stating that a policy-based approach is also necessary.

Left Perspective

The lawsuit directly targets a specific criminal enterprise.
The legal claims are based on the significant scale of the alleged criminal activity.
The suit employs powerful legal statutes to deter future crime.

Right Perspective

Legal action alone is viewed as insufficient to solve the problem.
Bipartisan legislation is seen as a necessary component of the solution.
The nature of the threat calls for a more comprehensive response.

Left Perspective

• The lawsuit directly targets a specific criminal enterprise. The legal action filed by Google in a U.S. District Court is aimed at what the company described as a criminal organization largely based in China. The goal of the suit is to dismantle this specific group and its phishing-as-a-service software kit, named "Lighthouse."

• The legal claims are based on the significant scale of the alleged criminal activity. According to Google’s general counsel, the operation has affected over a million victims in 120 countries. The company also claimed that the group has stolen between 12.7 million and 115 million credit cards in the U.S. alone by using fake texts to steal sensitive financial data.

• The suit employs powerful legal statutes to deter future crime. Google has brought claims under the Racketeer Influenced and Corrupt Organizations (RICO) Act, a law typically used to combat organized crime. By using this legal tool, the company said its action aims to disrupt the group and send a message that would deter similar fraudulent activities.

Right Perspective

• Legal action alone is viewed as insufficient to solve the problem. The article notes that alongside its lawsuit, Google itself stated that a policy-based approach is also necessary to combat cybercrime. This indicates a view that while individual lawsuits can be effective, they may not be enough to address the root causes of the issue.

• Bipartisan legislation is seen as a necessary component of the solution. Google's endorsement of three bipartisan bills designed to combat cybercrime is presented as a parallel effort to its legal action. This suggests that a broader, legislative framework is needed to create a more secure environment and effectively fight these types of scams.

• The nature of the threat calls for a more comprehensive response. The criminal group is described as using a "phishing-as-a-service" model and a public Telegram channel to coordinate its members. This organized and distributed structure suggests that tackling such threats may require systemic policy changes, rather than only pursuing individual criminal groups one by one.

How it may affect me

As a U.S. reader:

• Your personal financial data remains at risk from SMS phishing scams that impersonate services like the U.S. Postal Service to steal banking and credit card information.

• If the lawsuit is successful, you may receive fewer fraudulent texts in the future, as it could dismantle a major criminal group and deter similar operations.

• New federal laws designed to combat cybercrime may be passed, as this event highlights support for a broader policy response alongside individual legal actions.

Google Sues Alleged Cybercriminal Group Over Widespread SMS Phishing Scams

The BareStory

Left Perspective

Right Perspective

How it may affect me

Read the story at