Last weekend, the FBI Cleveland struck a blow against cybercriminals. The Chinese-based Phishing-as-a-Service (PhaaS) platform had been active since 2023. Now, the websites are adorned with an FBI banner indicating the seizure.
The FBI reports on “Operation Ghost Hook.” According to the report, law enforcement worked with Google and Lumen on measures against the criminal offering. “Outsider” or “Outsider Enterprise” offered “turnkey” phishing pages and infrastructure for money as a phishing-as-a-service platform. The phishing kits could carry out complex attacks against citizens of the USA and at least 54 other countries. All automated and AI-supported. Investigations have revealed that the Outsider-PhaaS platform has set up more than 8,000 unique phishing domains since July 2023. These are responsible for an estimated 3,870,000 stolen credit card details and associated losses of around 1.9 billion US dollars.
In the joint operation, the FBI and its partners seized several domains of the main administration servers. Additionally, a Shopify business page and account used to test the phishing service were seized. Investigators also froze 100,000 Tether (USDT) from the Outsider wallets. Thousands of phishing domains with US providers were seized; they now display the FBI seizure banner as part of “Operation Ghost Hook.” Law enforcement also obtained information customers of the criminal offering via an “outsider” Telegram bot.
The operation is part of the overarching “Operation Riptide,” an ongoing FBI campaign targeting the masterminds, infrastructure, and financial networks behind cybercrime.
In this context, Google has also explained that the company intends to take legal action against AI fraud, broadly termed “affirmative litigation.” In addition to patching security vulnerabilities and blocking fraudulent accounts, the company, together with law enforcement, also takes civil action against cybercriminals . This includes suing for domain blocks to dismantle their infrastructure and freezing funds.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
