Google sues Chinese group that used Gemini for phishing

Google has filed a lawsuit against Outsider Enterprise, a Chinese cybercrime group that used AI, including Gemini itself, to build phishing sites and blast scam SMS messages to Android users.

What the group did

Outsider Enterprise built a full-scale digital fraud operation powered by generative AI. The group used Google Gemini to automatically generate phishing web pages that closely copied official sites from Google and other well-known brands. AI made the group many times faster at building these sites: work that used to take days now takes minutes.

Alongside the sites, the group ran an aggressive SMS spoofing campaign. Over two weeks, the scammers sent 2.5 million fake text messages to Android users, each designed to look like an official notice from Google or another major company. The goal was the usual one: get the user to click a link, enter their credentials, or download a malicious app.

One detail makes this case especially telling: the group used Gemini, a tool built by the same company now taking it to court. It shows how easily publicly available AI tools can be turned against the organizations that built them.

Google's legal strategy

Google filed the suit on Friday, seeking to dismantle Outsider Enterprise's infrastructure entirely. Its demands include:

• transferring control of all domains used for phishing to Google
• shutting down the servers and accounts the group used
• barring its members from using Google products and platforms in the future
• recovering damages for the company and affected users
• publicly establishing the liability of specific individuals

Lawsuits are part of Google's consistent strategy against large-scale fraud. Criminal prosecution in international cases is slow and unpredictable, while a civil suit lets the company seize domains and freeze infrastructure faster. Each successful case also sets a precedent that makes life harder for the next group, at least in jurisdictions where Google can actually recover damages.

Why AI suits scammers

The use of Gemini for phishing is a clear example of a systemic problem facing every major AI company. Generative models can produce convincing copy, logos, site structure, and navigation — exactly what a scammer needs to impersonate a brand convincingly.

A polished phishing site used to require serious technical skills or hired specialists. Now it takes a few prompts. The barrier to entry for scammers has dropped sharply, while the credibility of their attacks has gone up.

Google and other AI developers keep tightening restrictions on dangerous use cases. But criminal groups adapt quickly: they combine several tools, use AI only at certain stages of an attack, or look for models without strict moderation.

What it means

Lawsuits are an important response, but not a sufficient one. While one group is being taken down, others tweak their schemes and keep going. Real progress requires AI companies not only to respond to incidents but also to build in abuse detection — before the damage reaches millions of victims.