Google Sues “Lighthouse” Over Massive Phishing Attacks

Google has filed a lawsuit to dismantle the Lighthouse phishing-as-a-service operation, a move backed by Google’s push for bipartisan bills in Congress to curb digital scams. The Lighthouse kit is marketed as a PhaaS platform, enabling bad actors to run sophisticated “smishing” campaigns at scale that impersonate trusted brands such as E-Z Pass to harvest sensitive details.

Google says it has identified at least 107 website templates that illegally feature its trademarks, mimicking legitimate sign-in screens to deceive users. The operation is said to have targeted over 1 million victims across more than 120 countries, with US damages described as ranging from 12.7 million to 115 million credit cards stolen. The legal action seeks to shut Lighthouse down by invoking the Racketeer Influenced and Corrupt Organizations (RICO) Act, the Lanham Act, and the Computer Fraud and Abuse Act.

In parallel, Google is pushing for legislation and rolling out smarter defenses, including AI-driven scam detection in Google Messages and expanded account recovery options.