"This AI-powered feature apparently stops 10 billion scam texts every month."
Outsider Enterprise operates through Telegram, Google says
In a legal filing, Google identifies a group it calls Outsider Enterprise and says the group operates through Telegram. According to Google’s filing, Outsider Enterprise markets what the filing describes as phishing-as-a-service: a turnkey offering aimed at people who "may not be technically savvy" enough to build fraudulent websites and run text-message campaigns on their own. The filing says the group provided instructions and infrastructure to support large-scale phishing operations.
Gemini AI used to create imitation websites for Google, YouTube, and New York's E‑ZPass
Google’s filing alleges that Outsider Enterprise taught users how to use Google’s Gemini AI to generate fraudulent websites that imitate legitimate services. The filing specifically cites imitation sites targeting Google, YouTube, and government agencies such as New York’s E‑ZPass. Google says the group offered nearly 300 scam templates, a catalog that — if accurate — would allow rapid replication of credential‑harvesting pages and other spoofed services across many campaigns.
Carrier coordination: AT&T, Verizon, and T‑Mobile blocked messages
Google reports that it worked with three major mobile network operators — AT&T, Verizon, and T‑Mobile — to block many of the malicious text messages tied to the operation. That cooperation is presented in Google’s legal documents as a mitigation step alongside other technical defenses, and it is cited as having reduced the reach of the campaigns driven by the Telegram-run service.
On-device detection in Google Messages and scale of filtered traffic
Google notes in its filing that its on-device scam detection in Google Messages probably helped reduce the number of successful phishing attempts. The filing states that the AI-powered Messages feature stops 10 billion scam texts every month, and Google suggests that it likely intercepted at least some Outsider Enterprise activity. That combination of carrier blocking and on-device filtering is presented as a material restraint on the effectiveness of the phishing-as-a-service model described in the filing.
What this means for carriers, security teams, and end users
- AT&T, Verizon, and T‑Mobile: The filing documents direct cooperation between Google and these carriers to block malicious short‑message campaigns, indicating carriers are a primary lever for rapid mitigation of text-based phishing tied to centralized services.
- Technologists and security teams: The alleged use of Gemini to automate website creation and the availability of nearly 300 templates highlights a scalable, AI-assisted threat model that defenders must detect and disrupt at both infrastructure and content levels.
- End users: Google’s claim that its on-device Messages detection stops 10 billion scam texts monthly is offered as evidence that some attacks never reach users’ inboxes; at the same time, the presence of an organized Telegram-run phishing service underlines ongoing exposure for those messages that do slip through.
Google has moved from detection and carrier cooperation into the courtroom, filing suit against the actors named in its documents. The filing frames the problem as an organized, productized fraud operation — one that paired an AI toolkit with hundreds of ready-made templates and a channel for distributing spoofed sites and message campaigns. Whether litigation, network blocks, and on-device filtering together will permanently disrupt an operation Google alleges runs through Telegram is an open question; the filing and subsequent reporting make clear, however, that the company is treating the activity as both a legal and technical problem that must be addressed on multiple fronts.
