Google Takes Alleged China-Based Cybercrime Group to Court Over Gemini-Driven SMS Phishing Aimed at Crypto Users

Google filed a lawsuit on June 12 against a suspected China-based cybercrime network it identifies as Outsider Enterprise, alleging the group used the company's Gemini AI to automate large-scale SMS phishing campaigns that impersonated legitimate brands and harvested financial credentials from hundreds of thousands of victims. Court documents say the defendants relied on Gemini to generate code and website templates that produced convincing phishing pages mimicking telecom portals and other services. The FBI alleges the operation created more than 8,000 phishing sites across dozens of countries. Google said it received about 55,000 reports of suspicious messages in Google Messages during the two-week period ending June 1, many of which it believes were connected to Outsider Enterprise. Filings estimate the network stole roughly 3.87 million credit card numbers and drove about $1.9 billion in losses since July 2023. Crypto users were also in the crosshairs. In addition to payment cards and account logins, the phishing infrastructure targeted cryptocurrency wallets and exchange credentials. The focus on digital-asset holders reflects a broader shift: crypto victims often have fewer recovery options than traditional banking customers, reinforcing the need for stronger custody and access controls such as hardware wallets and robust multifactor authentication. The suit lands as AI-enabled fraud accelerates across the U.S. The FBI reported 1,008,597 internet crime complaints in 2025, with crypto-related cases the largest category at 181,565 reports and about $11 billion in losses. For the first time, the FBI's Internet Crime Complaint Center (IC3) added a dedicated section on AI scams in 2025, logging 22,364 complaints that cost Americans nearly $893 million. Separately, the FBI's Operation Level Up, launched in 2024, has identified more than 8,000 crypto fraud victims and helped avert over $500 million in potential losses. Google said the goal of the case is to "permanently dismantle" the operation's core software developers. A successful outcome could set a notable legal precedent for holding operators and developers responsible for weaponizing AI tools. The episode also reinforces industry warnings that advanced AI models can be repurposed for fraud, an issue gaining urgency as major consumer tech companies, including Apple, integrate AI features into widely used products. For crypto readers, the takeaway is straightforward: generative AI is increasing both the scale and sophistication of phishing, and digital-asset holders remain prime targets. Pressure is likely to rise on platforms, exchanges, and AI providers to strengthen defenses, while regulators and law enforcement pursue more cross-border takedowns. Basic hygiene still matters: store assets in hardware wallets, use strong MFA, and treat unsolicited SMS links with skepticism.