Google has taken direct legal action to disrupt a massive global phishing operation, filing a civil lawsuit in the U.S. District Court for the Southern District of New York on November 12, 2025. The suit targets the alleged China-based operators of a prolific Phishing-as-a-Service (PaaS) platform known as Lighthouse.
According to the complaint, the Lighthouse platform democratized cybercrime by selling and leasing a phishing for dummies kit to a global network of criminals. These criminals, who may lack technical expertise, used the platform to conduct large-scale SMS phishing (smishing) campaigns.
Massive Global Impact
The operation has reportedly impacted over 1 million users in 120 countries. The primary attack vector involved SMS messages impersonating trusted American brands, most notably the U.S. Postal Service (USPS) and the E-ZPass toll system.
Attackers would send deceptive messages to victims, using lures related to fake package delivery notifications or outstanding toll fees. These messages contained links that redirected victims to fraudulent websites created and managed by the Lighthouse platform. The sites were designed to trick users into entering sensitive personal and financial information, including login credentials and credit card details, which were then harvested by the attackers.
Targeting Criminal Infrastructure
Google’s lawsuit is a strategic move aimed at dismantling the core infrastructure of the criminal enterprise. Rather than simply blocking the thousands of individual phishing sites that spring up, Google is attacking the source: the platform, tools, and servers that enable their creation. By targeting the PaaS operators, Google aims to permanently disrupt the service, making it more difficult and costly for criminals to launch such identity-based attacks.
This legal action is part of a growing trend of technology companies using their resources to actively pursue the operators of criminal infrastructure, supplementing the efforts of law enforcement. The lawsuit seeks to disable the servers and services associated with Lighthouse, providing a tangible disruption to the cybercrime ecosystem that relies on stolen credentials and financial data.
The move comes as phishing attacks have surged 76 percent year-over-year, with financial institutions and healthcare providers among the hardest hit. Organizations are increasingly adopting multi-layered verification systems and behavioral biometrics to combat the growing threat.
Sources: BleepingComputer, The Register, The Hacker News
—
By the ID Tech Editorial Team
