Scams & Phishing News FBI disrupts massive AI-powered phishing service using a million URLs

[Brownie2019]

Content source

https://www.bleepingcomputer.com/news/security/fbi-disrupts-massive-ai-powered-phishing-service-using-a-million-urls/

In a coordinated effort, the FBI, working with Google and Black Lotus Labs, has dismantled a massive Chinese phishing-as-a-service operation called Outsider Enterprise with thousands of phishing websites used to steal credit card data and passwords.

The cybercrime operation used AI and distributed phishing kits for campaigns impersonating various trusted brands in texts sent through AT&T, T-Mobile, and Verizon.

Outsider Enterprise has been active since at least 2023 and operated at a massive scale, with Google linking to it 9,000 fake websites and more than a million fraudulent URLs.

Authorities believe that phishing campaigns powered by Outsider Enterprise led to stealing more than 3.8 million credit card records, causing an estimated $1.9 billion in losses.

[subtitle]

The action against Outsider Enterprise has technical and legal components and is part of the FBI's larger Operation Riptide that targets cybercrime activity and infrastructure.

During the technical takedown, the FBI and partners seized multiple administration servers, a Shopify e-commerce storefront, and an account the threat actor used to test the phishing service.

Read more here:

FBI disrupts massive AI-powered phishing service using a million URLs

In a coordinated effort, the FBI, working with Google and Black Lotus Labs, has dismantled a massive Chinese phishing-as-a-service operation called Outsider Enterprise with thousands of phishing websites used to steal credit card data and passwords.

www.bleepingcomputer.com

 

[Bot]

Read more here:

FBI disrupts massive AI-powered phishing service using a million URLs

In a coordinated effort, the FBI, working with Google and Black Lotus Labs, has dismantled a massive Chinese phishing-as-a-service operation called Outsider Enterprise with thousands of phishing websites used to steal credit card data and passwords.

www.bleepingcomputer.com

This is a good reminder that “phishing-as-a-service” (PhaaS) has matured into an industrial-scale ecosystem: prebuilt kits, disposable domains, and centralized management that lets many criminals run campaigns quickly and cheaply.

What matters for everyday users
Even if a specific operation gets disrupted, the same playbook typically reappears under new infrastructure. The practical takeaways are:

• Treat unexpected SMS “account alerts,” “package delivery,” “bank verification,” and “password reset” links as untrusted, even if they look branded.
• Do not tap the link in the message; instead, open the official app or type the known-good domain manually.
• Use a password manager where possible. It helps because it usually won’t autofill on lookalike domains.
• Enable MFA, preferably an authenticator app or security key (SMS-based MFA is better than nothing, but SMS is a common target in these campaigns).

If you already clicked or entered information
Low-risk, standard next steps:

• Change the password for the affected account immediately (and anywhere else you reused it).
• Enable MFA and review account security settings (recovery email/phone, active sessions, forwarding rules for email accounts).
• For payment card exposure: contact your bank/card issuer promptly, monitor transactions, and consider a card replacement.
• Report the smishing message to your carrier (most support forwarding the message to 7726 / SPAM) and report the incident to relevant national reporting portals (in the US, IC3).

Why “AI-powered” matters (without the hype)
AI doesn’t magically bypass security controls, but it can improve scale and message quality (more convincing language, rapid variation, and localized lures). The core defense remains the same: verify the destination independently and don’t authenticate through unsolicited links.

Conclusion: takedowns are helpful, but user-side habits (no-link workflows, MFA, password manager, and quick incident response) are what reliably reduce risk over time.

Sources

• FBI disrupts massive AI-powered phishing service using a million URLs