🤚 The Open-Palm Indictment

The FBI, Google, and Black Lotus Labs just dismantled one of the largest phishing-as-a-service operations in history. The operation, called Outsider Enterprise, was a China-based cybercrime syndicate that sold AI-powered phishing kits through Telegram and managed to steal 3.8 million credit card records, causing an estimated $1.9 billion in losses. The takedown, part of the FBI’s broader Operation Riptide, involved seizing administration servers, a Shopify storefront, approximately $100,000 in USDT, and — in a delightfully modern detail — the Telegram bot the criminals used for customer support.

Yes, the phishing service had customer support. The criminals were running a SaaS business. With subscriptions. And a help desk.

👐 The Two-Handed Business Model Review

Let’s talk pricing, because Outsider Enterprise had the operational clarity that most legitimate startups only dream about. For $88 per week — or $200 per month if you committed to the annual-ish plan — customers received access to over 290 phishing templates mimicking banks, telecom providers, and government agencies. The kits enabled operators to launch fake text campaigns impersonating trusted brands like Google, sending messages through AT&T, T-Mobile, and Verizon networks designed to harvest credentials and payment data.

The scale was staggering. Google linked 9,000 fake websites and more than one million fraudulent URLs to the operation. In a two-week period in May alone, 2.5 million SMS messages were sent to Android users from Outsider Enterprise’s infrastructure. Android users flagged 55,000 of them as fraudulent, which means the other 2.445 million either looked convincing enough to ignore or arrived while people were doing something more important, like arguing about AI on Twitter.

The “AI-powered” label deserves scrutiny. Google’s June 12 federal lawsuit in Manhattan alleges the group used Gemini and other AI tools to generate and optimize phishing content at scale. Which means Google’s own AI was being used to impersonate Google. This is the cybersecurity equivalent of a locksmith discovering that someone cloned his master key using his own key-cutting machine — while he was in the shop.

🌿 The Gentle Awakening

There’s a philosophical discomfort here that goes beyond the numbers. Phishing has always been a volume game: send enough messages, and someone will click. But Outsider Enterprise industrialized it to a degree that would make a Silicon Valley growth hacker weep with admiration. They had product-market fit. They had recurring revenue. They had a customer acquisition funnel that went: Telegram channel → free trial → paid subscription → your grandmother’s credit card number.

The AI angle is the part that should keep people up at night. Phishing kits have existed for a decade, but they required at least some craftsmanship — someone had to write the templates, localize the language, make the fake bank login look convincing. AI demolishes that barrier entirely. A $200-per-month subscription to a phishing platform powered by frontier language models means that fluent, personalized, context-aware social engineering is now available to anyone with a Telegram account and a cryptocurrency wallet. The democratization of intelligence applies to criminal intelligence too.

👑 The Gold-Leaf Enforcement Reckoning

The enforcement actions were coordinated and symbolically satisfying: servers seized, domains redirected to FBI splash pages, crypto wallets frozen. But no arrests were announced. The infrastructure is down; the operators are presumably not. Outsider Enterprise has been active since at least 2023, meaning it ran profitably for three years before the coalition caught up. In startup terms, that’s a successful exit — just not the kind you celebrate on LinkedIn.

The $1.9 billion in estimated losses dwarfs the $100,000 in seized crypto by a factor of 19,000. If you’re keeping score at home, that’s a recovery rate of approximately 0.005%, which is still better than most ransomware negotiations but considerably worse than losing your wallet at a restaurant.

For Google, the lawsuit is both legal action and PR necessity. When your AI is being used to impersonate your brand in phishing campaigns that stole nearly four million credit cards, you need to be seen doing something more forceful than updating your Terms of Service. For the FBI, it’s another entry in the growing catalog of operations where international cybercrime rings are disrupted, publicized, and — notably — not imprisoned. The servers may be down, but the playbook is published. The next Outsider Enterprise is already reading the case study.

“The phishing service charged $88 per week, offered 290 templates, and had a Telegram help desk. We’ve evaluated Series A pitches with less product clarity.” — The Slap of Wisdom Venture Crime Desk, updating its competitive landscape spreadsheet