Google's own artificial intelligence became a weapon against millions of Americans this year. A Chinese cybercrime network called Outsider Enterprise weaponized Gemini—Google's flagship AI tool—to automate massive phishing scams, tricking people into handing over banking details and personal data through fake websites that looked disturbingly legitimate. Google just filed a lawsuit against the group, but the damage is already done, and it raises an uncomfortable question: how much of the AI revolution will criminals capture before we figure out how to stop them?
Here's how the scam worked in practice. Outsider Enterprise operated through Telegram, offering what amounted to a phishing-as-a-service marketplace. If you wanted to run a scam but didn't have the technical skills to build fake websites or launch text campaigns, they'd do it for you. The group published nearly 300 scam templates and provided detailed instructions on how to use Google's own Gemini AI to create convincing knockoffs of legitimate sites—Google login pages, YouTube interfaces, even New York's E-ZPass toll payment system. The cybercriminals essentially outsourced their criminal infrastructure to an AI that was specifically designed to help people build things faster.
The scale of what they accomplished is staggering. Google tracked 2.5 million malicious text messages sent to Android users, with about 55,000 of those hitting phones in just a two-week period last month. Behind those messages sat 9,000 fake websites and 1 million URLs. When victims clicked the links—often responding to messages about account problems or package delivery issues—they landed on AI-generated pages so well-crafted that distinguishing them from the real thing required genuine scrutiny. Once there, hundreds of people lost money. Google didn't quantify the total theft, but the numbers suggest we're talking about millions of dollars stolen through a single organized crime operation.
If you use Android or receive text messages, this should concern you directly. The Outsider Enterprise campaign shows that AI isn't just accelerating innovation in Silicon Valley—it's accelerating crime too. A criminal who once needed to hire a web developer or spend weeks learning to code can now ask Gemini to build a fake Google login page in seconds. The barrier to entry for sophisticated fraud has collapsed. What's particularly unsettling is that this happened in real-time, with Google's own product being repurposed against its own users. The company did respond—it worked with AT&T, Verizon, and T-Mobile to block messages, and Google Messages' built-in scam detection apparently stopped 10 billion spam texts monthly. But that's defensive. The criminals moved fast enough to hit millions before the defenses caught up.
This lawsuit against Outsider Enterprise is Google's attempt to fight back through the legal system, but it highlights a deeper problem the entire tech industry is grappling with. Every powerful AI tool that makes legitimate work easier also makes criminal work easier. As AI gets faster, cheaper, and more accessible, law enforcement and tech companies are playing catch-up. The real question isn't whether Google will win this lawsuit—it's whether companies can build safeguards fast enough to prevent the next operation from being twice as effective. For now, the best defense remains skepticism: verify unexpected messages through official channels, never click links in unsolicited texts, and assume that anything asking for your personal data might be exactly what it seems too good to be.