Google has launched a lawsuit against Lighthouse, a phishing platform based in China that allegedly provides cybercriminals with tools and services to conduct large-scale online scams. The group, known as Lighthouse Enterprise, reportedly markets its operations across forums, Telegram channels, and even YouTube — not only to promote its products but also to recruit, train, and expand its network. Criminal groups then use Lighthouse’s phishing kits to impersonate major organizations like Gmail, YouTube, the New York City government, and the U.S. Postal Service, stealing sensitive user data.
According to The Financial Times, Google’s legal action invokes U.S. racketeering and computer fraud laws in an effort to dismantle the infrastructure — including websites, domains, and servers — that enables these schemes.
“Criminals are abusing our brand’s trust to trick users into phishing traps,” said Halimah DeLaine Prado, Google’s general counsel. “By putting our engineers and lawyers to work, we’re able to go after these offenders directly. It’s a bit like whack-a-mole, but our actions can create a ripple effect that deters future attacks.”
Lighthouse’s operation reportedly functions like a business. Criminal clients choose from hundreds of pre-made phishing site templates developed by specialized teams. Another group obtains or purchases stolen personal data, while spammers distribute millions of fake text messages directing victims to the fraudulent websites. Once victims enter their credentials, the scammers either use the data for theft or sell it to other criminal networks.
Google claims that Lighthouse has victimized over 1 million people in 121 countries, causing an estimated $1 billion in financial losses. While the tech giant’s lawsuit may disrupt individual scammers, shutting down the entire Lighthouse operation will be a complex challenge. Given the profitability of such schemes, experts warn that even if Lighthouse is dismantled, similar networks could soon emerge to take its place.
