Google strikes back at scammers enabling those fake ‘stuck package’ texts

Google is suing dozens of people it asserts are involved in a large-scale phishing operation. Yesterday, Google filed a civil suit in New York aimed at dismantling an organization called Lighthouse, a “phishing-as-a-service” operation that Google says has been used to scam more than a million people all over the world.

In a blog post, Google details the Lighthouse operation: The kit generates text message-based phishing (or “smishing”) attacks that leverage existing brands in order to extract information from victims. If you’ve ever received a sketchy text that purports to be from a package delivery service, directing you to click a link to verify personal or payment info, it may have come out of Lighthouse. As Wired explains, Google’s legal action may not directly impact the individuals named in its suit, who are believed to be based in China. But the suit could give Google footing to pressure platforms that enable Lighthouse’s operation to take action.

Lighthouse comprises multiple layers of bad actors, Wired says, including data brokers who identify potential scam targets; spammers who are able to blast messages to many users at once; and data thieves who actually do the work of using phished information to access victims’ bank accounts. The system apparently offers hundreds of different scam templates that aim to impersonate communication from and official websites operated by more than 400 different organizations. Google’s suit says that 116 of these templates use either Google’s or one of its subsidiaries’ branding to try to trick targets into divulging sensitive information.

While the individuals Google’s suit targets, who are believed to reside outside of US jurisdiction, may not suffer legal consequences, the suit could still weaken Lighthouse’s operations. Wired points out that the suit names multiple Telegram account handles that have been promoting Lighthouse’s illicit services — Google’s legal action may provide leverage to pressure platforms like Telegram to take action to mitigate Lighthouse-related activity.