FBI and Google Dismantle 'Outsider Enterprise' Phishing Service

A coordinated joint operation between the FBI and Google has dismantled Outsider Enterprise, a large-scale phishing-as-a-service platform that operated thousands of fraudulent websites and caused an estimated $1.9 billion in financial losses. The takedown was announced on June 15, 2026.

Scale of the Operation

Outsider Enterprise represented one of the more comprehensive phishing platforms seen in recent years, combining automated site generation, credential harvesting infrastructure, and card exfiltration at industrial scale:

The platform's operators designed it to be scalable — new phishing sites could be spun up rapidly, targeting different industries, brands, and regions while sharing the same backend infrastructure for credential collection and card monetization.

How Outsider Enterprise Operated

Outsider Enterprise functioned as a phishing-as-a-service (PhaaS) platform, offering criminal operators a ready-made infrastructure for conducting credential and financial fraud campaigns:

1. Fake site generation — the platform created convincing spoofed websites mimicking banks, retailers, and popular services using customizable templates
2. Credential harvesting — phishing pages captured login credentials, payment card details, and personally identifiable information
3. Card exfiltration pipeline — stolen payment card data was automatically formatted, validated, and routed to a monetization backend
4. Anti-detection measures — the platform used rotating domains, obfuscated JavaScript, and cloaking techniques to evade browser security warnings and threat intelligence feeds

The FBI and Google Partnership

The joint nature of this operation reflects a growing model of public-private collaboration in cybercrime disruption. Google's involvement brought significant threat intelligence capabilities to the effort:

• Google Safe Browsing infrastructure had flagged and blocked many Outsider Enterprise domains, providing an extensive dataset of the platform's footprint
• Google's Threat Intelligence Group contributed technical analysis of the platform's infrastructure, domain registration patterns, and backend systems
• FBI investigators coordinated legal action — including seizure orders, domain takedowns, and criminal referrals — using technical leads developed through the partnership

This cooperation model has become more common in takedowns of large-scale cybercrime infrastructure, where private sector visibility into internet-scale malicious activity complements law enforcement's legal authority to act.

Impact on Victims

With nearly 4 million credit cards stolen, the downstream victim impact from Outsider Enterprise was substantial. Stolen payment card data from PhaaS platforms like this one typically flows through several stages before causing direct financial harm to individuals:

1. Carding forums and dark web markets — cards are listed for sale in bulk
2. Card-not-present (CNP) fraud — purchased card data is used for online purchases before the card is cancelled
3. Money mule networks — fraud proceeds are laundered through network of accounts before reaching criminal operators

The $1.9 billion loss figure likely represents a combination of direct card fraud losses, bank and merchant chargebacks, and operational costs borne by financial institutions responding to the fraud.

What This Means for Defenders

Despite the takedown, organizations should not assume the threat has fully dissipated:

• Copycat platforms — the PhaaS model is well-documented; other operators will attempt to fill the void left by Outsider Enterprise's disruption
• Residual stolen credentials — card data and credentials harvested before the takedown may remain in circulation on underground markets
• Infrastructure reuse — threat actors associated with the platform may attempt to reconstitute operations using modified infrastructure and new domain registrations

Practical Defensive Measures

For organizations:

• Enable and enforce multi-factor authentication across all externally-facing login portals to limit the value of harvested credentials
• Integrate Google Safe Browsing or equivalent URL reputation feeds into web proxy and email security tooling
• Monitor for domain spoofing of your brand using typosquat detection services

For individuals:

• Check whether your payment cards may have been compromised using bank fraud alerts
• Use virtual card numbers for online transactions where possible
• Enable transaction notifications on all payment cards for immediate fraud detection

Law Enforcement Actions

While specific arrests and charges were not detailed in the initial announcement, the scale of the operation — spanning 9,000+ domains and $1.9 billion in losses — would typically trigger multi-jurisdiction criminal referrals and warrants against platform operators and major customers of the service.

The FBI's Internet Crime Complaint Center (IC3) continues to accept reports related to phishing fraud at ic3.gov.

References

• SecurityWeek — FBI, Google Dismantle 'Outsider Enterprise' Phishing Service
• FBI Internet Crime Complaint Center (IC3)
• Google Safe Browsing
• CISA — Phishing Guidance