Google Sues Chinese Cybercriminals Behind ‘Lighthouse’ Phishing Kit

According to SecurityWeek, Google has filed a lawsuit against a cybercrime group believed to be operating out of China, known as Smishing Triad. The group has been active since at least 2023, targeting users worldwide with large-scale SMS phishing campaigns that impersonate toll and package delivery services, banks, healthcare organisations, online payment platforms, law enforcement, and social media services.

Google says Lighthouse, a phishing‑as‑a‑service kit, enabled the targeting of more than one million users across over 120 countries, with an estimated 12 million to 115 million credit cards stolen in the United States alone; Palo Alto Networks reported that the campaign involved more than 194,000 malicious domains. Google identified over 100 phishing website templates impersonating its brand and services.

The lawsuit invokes the Racketeer Influenced and Corrupt Organisations Act, the Lanham Act, and the Computer Fraud and Abuse Act in an effort to shut the operation down, with Halimah DeLaine Prado explaining the aim to dismantle the core infrastructure.