Google sues Chinese network that used Gemini to scam

What happened?

On June 12, 2026, Google announced a lawsuit against a Chinese cybercrime organization it calls Outsider Enterprise. According to legal documents, the group operated through Telegram channels offering a phishing-as-a-service (phishing-as-a-service, PhaaS). They provided instructions and templates for non-technical users to create fraudulent websites mimicking Google, YouTube, and government agencies like New York's E-ZPass toll system. To do this, they used Gemini, Google's generative AI model, to automate the creation of these pages.

According to Google data, the network sent over 2.5 million fraudulent text messages to Android users in a two-week period in May 2026. Of these, about 55,000 were reported by users themselves. In total, Google has identified 9,000 fake websites and more than 1 million URLs linked to this operation. Financial losses are estimated in the millions of dollars and affect hundreds of thousands of victims.

Why is this important?

This case is significant for several reasons. First, it demonstrates how generative AI can be used for criminal purposes, lowering the technical barrier needed to launch large-scale phishing campaigns. Second, Google's own technology (Gemini) is being used to attack its users, posing a reputational and security challenge for the company. Third, the lawsuit reflects a shift in Google's legal strategy, seeking not only to dismantle the criminal infrastructure but also to push for updated laws against fraud in the AI era.

The case also highlights the scalability of AI-assisted fraud: while creating a phishing site used to require programming and design skills, now a natural language instruction to a model like Gemini can generate convincing pages in seconds. This exponentially multiplies scammers' capabilities.

What consequences will it have?

Google has requested the court for injunctive relief to dismantle Outsider Enterprise's infrastructure, including shutting down Telegram channels and removing fraudulent domains. Additionally, the company is collaborating with AT&T, T-Mobile, and Verizon to block malicious text messages, and with the FBI for criminal prosecution.

In the long term, this case could set a legal precedent regarding the responsibility of AI providers when their technology is used to commit crimes. Although Google is not directly liable, the lawsuit seeks court recognition of the need for stricter laws specifically addressing malicious AI use. It is also likely we will see tougher usage policies for Gemini and other generative models to prevent their use in fraudulent activities.

For users, the main consequence is the need to be extra cautious about unsolicited text messages, even if they appear to come from known companies. Google already uses AI tools to detect and block such scams, claiming it intercepts over 10 billion fraudulent messages per month. However, the sophistication of attacks requires constant vigilance.

What should readers know?

• Do not click on links in unsolicited text messages, even if they look legitimate. Always verify the official URL by typing it directly into the browser.
• Enable two-step verification on all important accounts, especially Google and financial services.
• Keep your operating system and apps updated, as updates often include security patches.
• Be wary of urgent offers or alerts that request personal information or immediate payment.
• Report any suspicious SMS to authorities or your phone carrier.

“Generative AI is democratizing both legitimate innovation and criminal activity. Google's lawsuit against Outsider Enterprise is a reminder that digital security must evolve at the same pace as technology.”

For more information, see Google's official blog post (source: Google Blog) and reports from TechCrunch and Ars Technica.