Google has launched a federal lawsuit against a foreign cybercriminal ring accused of orchestrating vast phishing scams that impersonated the U.S. Postal Service, New York City government websites and other trusted entities — a scheme that lured millions of Americans into surrendering payment data and sensitive personal information.

The complaint, filed Wednesday in New York federal court, takes aim at the shadowy group behind massive SMS-based phishing operations, known as “smishing,” and alleges they built a turnkey software platform called Lighthouse — a plug-and-play “phishing for dummies” toolkit enabling criminals with minimal technical skills to deploy advanced scams at scale.

Google says developers in China created and commercialized Lighthouse as a phishing-as-a-service engine. The platform has reportedly powered attacks in at least 121 countries, spawning roughly 200,000 fraudulent websites over just 20 days, drawing in more than 1 million potential victims during that short span.

“Defendants are foreign cybercriminals engaged in relentless phishing attacks against millions of innocent victims, including Google customers,” the complaint states. “Their schemes have stolen millions of dollars and misused Google’s trademarks and services.”

The 50-page filing accuses the operation of violating the RICO Act, the Lanham Act, and the Computer Fraud and Abuse Act, forming what Google describes as a coordinated criminal enterprise.

Google: Lighthouse Fuels Industrial-Scale Fraud

Phishing Attacks Masquerading as Trusted Institutions

Halimah DeLaine Prado, Google’s general counsel, detailed the threat in a Wednesday blog post, stating the company filed suit to dismantle Lighthouse and the criminal ecosystem surrounding it.

“The scam is straightforward: criminals send a text with a link that persuades recipients to hand over email credentials, banking information and other private data,” Prado wrote. “They illegally appropriate Google’s trademarks to make fake websites look legitimate. We identified more than 107 website templates using Google-branded sign-in screens to deceive victims.”

Prado added that Google is backing bipartisan congressional efforts aimed at giving agencies such as the USPS and systems like New York’s E-ZPass better tools to defend against catastrophic smishing campaigns.

A Fast-Mutating Enterprise

Google’s complaint underscores that dismantling the so-called Lighthouse Enterprise will require sustained effort because the criminal network quickly retools and launches new attack waves.

According to the filing, Lighthouse’s operators run online discussion forums used to coordinate attacks, recruit new participants, distribute the software, and refine techniques to maximize efficiency. Members allegedly exchange training materials, promote phishing templates, and sell licenses to Lighthouse like any commercial product.

Google Seeks Permanent Injunction, Damages

Google is asking the court for a judgment against “Does 1–25,” the unnamed individuals and groups behind Lighthouse, along with a permanent injunction barring future operations and a full award of actual and statutory damages.

Google’s legal team includes Laura Harris and Christine M. Carletta of King & Spalding LLP, and Sumon Dantiki of Baker McKenzie.

Counsel for the unidentified defendants could not be reached, and Google acknowledged it does not yet know the true identities of those behind the Lighthouse Enterprise.