Dismantling of The Outsider Phishing-as-a-Service Platform

• •The Outsider phishing platform was linked to $1.9 billion in losses and 3.87 million stolen cards.
• •Tapetum Labs identified 123,638 victim IPs across over 1,000 phishing domains.
• •The operation used SMS phishing to target users impersonating trusted brands globally.

In June 2026, the FBI and Google dismantled a major phishing-as-a-service platform known as The Outsider, which had been linked to over 9,000 phishing sites and approximately 3.87 million stolen credit cards, resulting in estimated losses of $1.9 billion since July 2023. The operation utilized SMS phishing (smishing) to target users globally, impersonating trusted brands. Tapetum Labs conducted an investigation revealing a backend API that leaked sensitive operational data, including victim IP addresses and payment statuses. The research identified 123,638 victim IPs across 1,017 unique phishing domains over a five-month period. The platform's infrastructure included typosquatted domains and was hosted on Tencent servers, obscured by Cloudflare. The investigation's findings were publicly shared in a two-part series, with Part 1 detailing the initial discovery and Part 2 providing victim counts and revenue estimates.