Google Alleged Outsider Enterprise Used Gemini to Create Phishing Sites for Text-Message Scams

May 1, 2026

Google alleged in a civil lawsuit that the China-based network Outsider Enterprise used Gemini and other AI tools to help create phishing websites for large-scale text-message scams impersonating companies and government services. Google said the network coordinated through Telegram, generated thousands of fake sites and fraudulent URLs, sent 2.5 million Android messages during a two-week period in May 2026, and financially scammed hundreds of thousands of people.

Matched TAIM controls

Suggested mapping from embedding similarity (not a formal assessment). Browse all TAIM controls

MAP 4.1 — similarity 0.587, rank 1. TAIM detail and related incidents →
GOVERN 6.1 — similarity 0.583, rank 2. TAIM detail and related incidents →
MAP 4.2 — similarity 0.561, rank 3. TAIM detail and related incidents →

Alleged deployer: scammers, outsider-enterprise, scammers-in-china, cybercriminals, cybercriminals-in-china
Alleged developer: google, google-deepmind, large-language-model-developers
Alleged harmed parties: google, google-users, android-users, consumers, e-zpass, united-states-postal-service, youtube

AI governance case studies

For forensic AI governance failure analysis (TAIMScore™ case studies), browse Human Signal’s Failure Files™.

Source

Data from the AI Incident Database (AIID). Cite this incident: https://incidentdatabase.ai/cite/1534

Data source

Incident data is from the AI Incident Database (AIID).

When citing the database as a whole, please use:

McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. In Proceedings of the Thirty-Third Annual Conference on Innovative Applications of Artificial Intelligence (IAAI-21). Virtual Conference.

Pre-print on arXiv · Database snapshots & citation guide

We use weekly snapshots of the AIID for stable reference. For the official suggested citation of a specific incident, use the “Cite this incident” link on each incident page.