- Google is suing Lighthouse Enterprise for running a global phishing-as-a-service scam
- The batch created 200,000 fake websites in 20 days and targeted more than a million victims worldwide.
- Lighthouse abused Google’s resources and may have compromised up to 115 million US credit cards
Google is suing “Lighthouse Enterprise,” a major Chinese global fraud company that facilitated the theft of millions of credit cards and hundreds of millions of dollars.
In a recent federal lawsuit filed in the Southern District of New York, Google revealed plans to sue a group of foreign criminals for running a large-scale phishing-as-a-service (PhaaS) operation.
According to the complaint, the group developed and sold a phishing kit called Lighthouse that allowed even novice users to create fake websites impersonating trusted institutions. The kit, marketed on Telegram and YouTube, offered hundreds of pre-built templates and tools to launch large-scale e-commerce and smishing scams, allowing users to create fake websites impersonating government agencies, financial firms and Google, among others.
Unknown number of “facts”
Google claims that the Lighthouse platform was used to create 200,000 fake websites in 20 days, targeting more than 1 million victims in 121 countries.
Citing researchers, Google estimates that between 12.7 million and 115 million credit cards may have been compromised by the Lighthouse attacks in the US alone.
The exact number of people performing the operation is unknown. The lawsuit refers to the people as “Doe” 1-25, although Google has acknowledged that the actual number of people is likely much higher.
In some cases, scammers created fake USPS package delivery text messages or alerted victims of unpaid tolls. They sometimes create fake online stores that steal users’ payment information and often use the stolen information to load victims’ credit cards into digital wallets to make unauthorized payments.
Google says Lighthouse operators have misused Google logos and trademarks, served ads through Google Ads, and even uploaded tutorials to YouTube showing how to run these scams.
The hackers damaged Google’s reputation, violated its terms of service and forced the company to spend hundreds of hours investigating and shutting down fake accounts, the company concluded.
This is not the first time Google has sued Chinese citizens for cybercrime, but often the lawsuits fail because China rarely extradits its citizens to the US, especially when it comes to cybercrime.
IN the record