This Is the Platform Google Claims Is Behind a ‘Staggering’ Scam Text Operation
Chinese cybercriminals are scam the world. Over the past several years, these scammers have sent millions of fraudulent text messages – often posing as USPS or toll road collection companies – and have reportedly made more than $1 billion from their brazen schemes. Text scam groups pose a prolific – and annoying – threat to millions of people.
Now, in one of the highest-profile actions against scammers yet, Google is suing alleged members of a “relentless” Chinese smishing group that it says has attempted to defraud people in more than 120 countries around the world. In a civil suit filed today in the Southern District of New York, United States, Google alleges that 25 anonymous individuals operated as part of the “Lighthouse” fraud ring and targeted millions of Americans with text messages in a “staggering” operation.
In addition to “stealing” information and money from people around the world, Lighthouse Enterprise, which is sometimes known as part of the “Smishing Triad,” also “preys upon the public’s trust in Google” by using its logos on fraudulent websites and abusing its systems and technology, the company’s lawsuit claims. “The increase in scams is largely driven by organized crime networks, and most of them are transnational,” says Halimah DeLaine Prado, Google’s general counsel, in an interview with WIRED. “The Lighthouse network has enormous reach. »
The Lighthouse group is one of several Chinese-language smishing groups that have emerged in recent years. Typically, groups broadcast fraudulent messages to thousands of people via SMS, Google’s RCS service or Apple’s iMessage. Each fraudulent text impersonates an organization, such as a delivery company, bank or law enforcement agency, and includes a link to a fraudulent website. If someone enters their details on these fake websites, the scammers can collect their personal information and banking details in real time. Some groups are also known to create fake online shopping websites that can also steal data.
At the heart of Lighthouse’s operations is its scam software, called Lighthouse. This software is developed by cybercriminals and then sold as a subscription service to less technically savvy fraudsters who use it to send fraudulent text messages. Fraudsters can purchase “weekly, monthly, seasonal, annual, or ongoing” subscriptions to use the software, Google’s lawsuit claims.
“The Lighthouse platform is a phishing tool as a service used by cybercriminals to steal banking and card information, offering ready-made phishing templates, fake websites and back-end management tools, enabling the collection of usernames, passwords and one-time codes, and it supports large-scale message delivery through the Rich Communication Services (RCS) channels of iMessage and Google Messages rather than simple SMS messages,” said Halit Alptekin, director of intelligence at security firm Prodaft, who has been tracking the Chinese phishing ecosystem. “It uses advanced anti-evasion techniques such as IP and user agent-based filtering, time-limited URLs, and domain rotation to hinder detection,” explains Alptekin.
