The civil suit against a Chinese network Google says used Gemini to build phishing kits at scale pairs a restraining order with carrier blocking, FBI coordination, and a seven bill federal package.
Phishing kits that used to take a skilled developer weeks to build are now being generated by a large language model in minutes, then franchised to affiliates who blast them at US phone numbers through Telegram. That industrialization of fraud is what Google's civil lawsuit, filed this week against a Chinese network called Outsider Enterprise, was designed to confront: not a single bad actor, but a scalable, AI-powered production line for impersonating Google, YouTube, the US Postal Service, and New York's E-ZPass toll service.
The complaint, announced on Google's "The Keyword" blog and reported by Engadget, lays out an unusually detailed operating picture for a two-week window in May 2026. Google says it counted 9,000 fake websites, roughly 1 million fraudulent URLs, 55,000 spam-text reports from Android users, and about 2.5 million messages containing Outsider-generated links sent to Android phones. The company frames those numbers as evidence of a single coordinated operation rather than thousands of independent scams, which is the legal theory that lets it seek a restraining order against the group as a whole.
Google's general counsel, DeLaine Prado, told The New York Times that this is Google's "first coordinated effort and lawsuit" of this kind, a framing Engadget carried in its reporting. That word "coordinated" is doing real work. The suit is paired with a synchronized carrier response: AT&T, T-Mobile, and Verizon are blocking scam texts at the network level, with AT&T's statement appearing on Google's blog alongside an on-record FBI statement from Cyber Division assistant director Brett Leatherman.
According to the Google filing and blog post, the network distributes Gemini-generated phishing kits through Telegram channels, hands them to affiliates, and runs SMS campaigns that impersonate trusted US brands. The kits let low-skill operators stand up convincing fake login pages for Google, YouTube, USPS, and E-ZPass in minutes. Google says "hundreds of thousands" of victims were financially scammed, with losses "estimated in the millions," though the company acknowledges those are its own figures rather than court-adjudicated totals.
What is not in the public record is equally important. Google controls the model that produced the kits, and the announcement does not disclose what internal guardrails failed, were bypassed, or never existed. That gap is the part of the story most likely to surface in court filings and in Congress, where Google is lobbying for a package of bipartisan bills it has been publicly naming for months.
The legislative slate includes the National Strategy for Combatting Scams Act, the Strategic Task Force on Scam Prevention Act, the STOP Scams Against Seniors Act, and what Google calls the AI Plan act, with three additional unnamed bills bringing the company's stated total to seven. Rep. Brian Fitzpatrick (R-PA) and Rep. Josh Harder appear in Google's post as supporters. None of these bills are law, and the package is best read as Google's preferred policy direction rather than imminent legislation.
The restraining order Google is seeking is also still pending. If granted, it would let the company demand that domain registrars, hosting providers, and Telegram take down the network's infrastructure at scale. If denied, the suit would still produce discovery that could identify individual operators and expose the financial plumbing underneath the affiliate model. Either way, the litigation will test whether a court will treat an AI-generated phishing kit, an affiliate network on a foreign messaging app, and a US carrier's network-level blocks as components of a single coordinated enterprise, the way Google is asking it to.
What the next phase of this story tests is whether the template holds. A Gemini-generated kit, a Telegram distribution channel, a US carrier willing to block at the network, an FBI statement on the record, a civil complaint naming the operation, and a legislative wish list in Congress: that is the full stack Google just put on the table, and it is the stack the next AI fraud case, from any company, will be measured against.