Google Sues ‘Lighthouse’ Phishing-as-a-service Kit Behind Massive Phishing Attacks

Google security researchers recently uncovered a sophisticated criminal operation called “Lighthouse” that has victimized over one million people across more than 120 countries.

This phishing-as-a-service platform represents one of the most damaging SMS-based scam networks in recent years, prompting Google to file litigation aimed at dismantling the entire operation.

The attack’s scale reveals how well-organized cybercriminals have become, deploying coordinated attacks that exploit trusted brand names to trick victims into surrendering sensitive information.

The Lighthouse platform enables attackers to launch massive “smishing” campaigns, which are phishing attacks delivered through text messages rather than email.

Criminals using this kit send deceptive SMS messages pretending to come from legitimate companies like E-Z Pass, USPS, and toll collection services.

These messages typically prompt recipients to click links that lead to fraudulent websites designed to steal credentials and financial data.

Google security analysts identified at least 107 website templates featuring Google’s branding on sign-in screens specifically crafted to appear legitimate.

These fraudulent websites asked unsuspecting users to enter email addresses, passwords, banking credentials, and other sensitive information.

The operation has stolen between 12.7 million and 115 million credit cards in the United States alone, representing a significant financial impact to victims.

Technical Infrastructure and Attack Mechanism

The Lighthouse platform operates as a complete criminal service offering, providing bad actors with readily-made phishing kits and infrastructure to execute attacks at scale.

The service simplifies the attack process by allowing operators with minimal technical expertise to launch convincing campaigns.

Criminals can customize templates for different target brands, manage victim databases, and harvest stolen credentials through a centralized command-and-control infrastructure.

Google’s legal action targets the operation under multiple laws, including the Racketeer Influenced and Corrupt Organizations Act, the Lanham Act for trademark violations, and the Computer Fraud and Abuse Act.

The company is also implementing defensive measures, including AI-powered detection systems to flag suspicious messages and expanded account recovery options to help compromised users regain access to their accounts more safely.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.