Google has filed a lawsuit against a group of Chinese hackers running a platform called “Lighthouse” that sells phishing services for a monthly fee. The group provides its services to clients to launch large-scale phishing and smishing (SMS phishing) campaigns. Google says bad actors typically send emails or text messages that link to fake websites pretending to be legitimate pages from established brands like USPS and EZ Pass, in order to trick people into entering their log-in and other sensitive details. The company found at least 107 sign-in screen templates bearing Google branding that were designed to steal people’s log-in information.
In its announcement, Google said that one million people in 121 countries have fallen victim to online scams using Lighthouse and that bad actors have already stolen $1 billion. In the US alone, they have got their hands on 12.7 million to 115 million credit card numbers. The most popular scheme involves pretending to be USPS and telling victims they will have to pay for re-delivery of a package stuck at the post office.
In form of financial Times According to reports, Google cited data from cybersecurity company Silent Push as an example in its lawsuit, which said the Chinese criminal group “Smishing Triad” used Lighthouse to create 200,000 fake websites earlier this year. Those websites apparently received 50,000 visits per day and millions of US credit cards were compromised within a 20-day period. The company is bringing claims under the US Racketeer Influenced and Corrupt Organizations Act, the Lanham Act and the Computer Fraud and Abuse Act. If the company wins, it will allow Google to work with carriers and website hosts to take down the operation’s domains and servers.
In addition to filing the lawsuit, Google is also supporting bipartisan bills in Congress that target foreign cybercriminals. One bill would enable state and local law enforcement to use federal grant funds to investigate financial fraud targeting retirees. The second objective is to establish a task force to stop foreign robocalls in the US. The last scam targets complexes, or centers that serve as a base for operating the scam, and intends to provide assistance to survivors who were trafficked and forced to work for those centers.