On November 13, 2025, US tech giant Google filed a lawsuit against a criminal organization based in China in the Southern District Federal Court in New York on Wednesday, November 12. The organization is accused of being involved in a large-scale phishing attack.
According to the Financial Times, these fraudulent activities have deceived one million people in 121 countries and regions, resulting in losses of $1 billion to the victims.
Google’s lawsuit documents reveal that this criminal organization operates a platform called Lighthouse, which charges a monthly fee to provide “phishing services” to assist criminals in launching large-scale scam activities to steal sensitive information.
These phishing services generate fake emails, texts, and websites that impersonate Google-owned brands such as Gmail and YouTube, as well as other institutions like the New York City government or the United States Postal Service (USPS).
Criminals can choose from hundreds of fake website templates created by the “developer team” of the Lighthouse platform and pay in cryptocurrency as fees. A “data team” then provides victim lists to the “spam text team,” which sends millions of text messages to victims containing links to these websites, enticing them to enter personal and financial information. This information is then stolen and used to access bank or email accounts, top up digital wallets, or sold for profit.
Google aims to win a judgment based on US laws related to extortion and computer fraud to enable cooperation with mobile network operators and website hosting companies to shut down the domains and servers supporting these phishing activities.
Halimah DeLaine Prado, General Counsel at Google, told the Financial Times, “Criminals are taking advantage of the trust and reputation of our brand to lure users into unsafe phishing attacks. It is essential for our engineers and lawyers to truly fight on behalf of these users.”
Google states that these phishing texts, appearing legitimate, often warn recipients of being “stuck parcels” or “unpaid tolls,” but are actually phishing texts. This is a method of phishing fraud that deceives recipients into disclosing personal sensitive information (such as passwords and credit card numbers), which is then stolen.
According to NPR, Prado mentioned that over a hundred templates used to create fake websites utilize Google’s logo in positions where users are prompted to log in or make payments, giving the false impression of a legitimate site. “We are a global company, and this impacts all of our users,” she said. “We are concerned that this could damage user trust and make it difficult for them to determine which sites are safe.”
Prado declined to disclose the amount of losses suffered by Google, calling it “somewhat difficult to estimate,” but she cited a vivid example to illustrate the extensive reach Google believes this criminal organization has. According to the lawsuit, from July 2023 to October 2024, Lighthouse created or used 32,094 phishing websites impersonating the US Postal Service. Prado estimates that just in the US, these phishing sites could lead to the exposure of credit card information ranging from 12.7 million to 115 million cards.