Google sues to stop Lighthouse phishing-as-a-service targeting millions globally

Traders Union
All News
Financial News
Google sues to stop

All news

Top Stories

Editors' Picks

Crypto

Financial News

Currencies

Market Voices

Companies

Regulators

Central Banks

Yaroslav Dmytrenko

12.11.2025

Google sues to stop Lighthouse phishing-as-a-service targeting millions globally — Google seeks injunction against phishing-as-a-service used in global scams

On November 12, Google said it filed a civil lawsuit in the U.S. District Court for the Southern District of New York seeking to stop the spread of the Lighthouse phishing software package, which the company estimates was used to create 200,000 fraudulent websites and attacked more than 1 million potential victims in at least 121 countries.

Google says this is the first lawsuit of its kind specifically aimed at phishing-as-a-service. For a monthly fee, the Lighthouse software suite — reportedly operated by actors in China — lets cybercriminals easily launch fraudulent SMS campaigns and create fake websites that impersonate legitimate brands.

The complaint describes Lighthouse as part of a “relentless phishing campaign” that affected over a million people and may have compromised between 12.7 million and 115 million credit cards in the U.S. in a single SMS-based operation.

To activate the malicious toolkit, users subscribe via Telegram, where a self-service bot lets them pay for access weekly, monthly, seasonally, annually, or permanently. Subscribers choose from more than 600 spoofing templates that mimic over 400 organizations, including the U.S. Postal Service, New York government agencies, Apple, banks, and toll-collection agencies.

Lighthouse also allows users to filter phishing templates by geographic region, making it easy for criminals to pick counterfeit websites that will resonate with local victims.

“They prey on users’ trust in reputable brands like E-ZPass, the U.S. Postal Service, and even us at Google… The idea is to stop the further spread of the malware, deter others from doing the same, and protect both users and the brands that have been misused on these sites from further harm,” Google’s chief litigation counsel, Halima DeLaine Prado, told CNBC.

A multi-layered criminal syndicate with billion-dollar turnover

Security experts have labeled the criminal group the “Smishing Triad.” According to the latest FBI data, criminals using this toolkit stole more than $16 billion from consumers over the past year.

The program developed by the criminals logs keystrokes in real time, so victims of fake sites do not even need to press a “submit” button for their data to be stolen. The software also defeats multi-factor authentication by prompting victims to enter codes on counterfeit screens.

In the complaint, Google portrays Lighthouse as a fully fledged criminal organization with distinct teams handling development, data brokering, spam distribution, financial theft, and marketing.

Data brokers harvest personal information from breaches, social networks, and public sources. Spammers use phones, modems, and SIM cards for mass messaging. The so-called “theft group” uses stolen data to empty bank accounts, launder money, and resell credit card data on the dark web.

Administrators run training courses, answer questions, and post screenshots of brokerage accounts with multi-million balances to entice new fraudsters to “get started.”

Some Lighthouse users even bought online advertising, including Google Ads, to redirect victims to fake retail sites selling everything from phone cases to groceries.

As we wrote, Alphabet stock hits new record high amid cloud partnerships and dovish Fed outlook

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.