Google Sues to Disrupt Chinese SMS Phishing Triad

Google has filed suit in the Southern District of New York on 12 November 2025 to unmask and disrupt 25 “John Doe” defendants linked to Lighthouse, a sophisticated China-based phishing kit used to impersonate brands and convert phished card data into mobile wallets. The effort targets Lighthouse as part of the broader Smishing Triad, a cluster of phishing-as-a-service operations responsible for sending millions of text messages that spoof trusted brands and lure victims into revealing one-time codes.

Google says Lighthouse has harmed more than a million victims across 120 countries, with templates for over 600 phishing sites targeting more than 400 entities and logos appearing on at least a quarter of them. The complaint alleges trademark violations and pursues the case under the RICO Act, describing threat actor groups including a developer, data broker, spammer, theft, and administrative group that collaborate across channels such as YouTube and Telegram.

According to Silent Push, whose May report is cited in the suit, the Smishing Triad rotates domains and uses two Chinese hosting companies, Tencent and Alibaba.