Google has launched a federal lawsuit against a foreign cybercriminal ring accused of orchestrating vast phishing scams that impersonated the U.S. Postal Service, New York City government websites and other trusted entities — a scheme that lured millions of Americans into surrendering payment data and sensitive personal information.
The complaint, filed Wednesday in New York federal court, takes aim at the shadowy group behind massive SMS-based phishing operations, known as “smishing,” and alleges they built a turnkey software platform called Lighthouse — a plug-and-play “phishing for dummies” toolkit enabling criminals with minimal technical skills to deploy advanced scams at scale.
Google says developers in China created and commercialized Lighthouse as a phishing-as-a-service engine. The platform has reportedly powered attacks in at least 121 countries, spawning roughly 200,000 fraudulent websites over just 20 days, drawing in more than 1 million potential victims during that short span.
“Defendants are foreign cybercriminals engaged in relentless phishing attacks against millions of innocent victims, including Google customers,” the complaint states. “Their schemes have stolen millions of dollars and misused Google’s trademarks and services.”
The 50-page filing accuses the operation of violating the RICO Act, the Lanham Act, and the Computer Fraud and Abuse Act, forming what Google describes as a coordinated criminal enterprise.
