FBI's Operation Riptide seizes servers behind the Outsider Enterprise phishing ring

The Federal Bureau of Investigation has seized the administration servers, a Shopify storefront and a Telegram bot tied to Outsider Enterprise, an AI-assisted phishing-as-a-service operation, in a takedown disclosed on June 14, 2026 and code-named Operation Riptide. Working with Google and the Black Lotus Labs threat-research team, agents also seized roughly $100,000 in USDT from the group's payment wallets.

The move escalates a case that had so far played out only in court. Google filed a civil lawsuit against the operators on June 12; the FBI action two days later adds physical infrastructure seizures, with thousands of phishing domains registered at US providers now redirecting to an FBI splash page.

The scale is what authorities are pointing to. Google said it has linked the China-based Outsider Enterprise to about 9,000 fake websites and more than 1 million fraudulent URLs, and that over one two-week stretch this past May the network sent 2.5 million messages to Android users. Investigators in the broader case estimate the operation stole on the order of 3.8 million credit card records and caused roughly $1.9 billion in losses, with phishing kits sold through Telegram for as little as $88 a week. Google's own post is more conservative, putting victim losses "in the millions."

Those totals are estimates attributed to investigators and to Google's analysis, not figures tested in court, and the criminal case names no convicted defendants at this stage. Google's post carries a statement from Brett Leatherman, assistant director of the FBI's Cyber Division.

Google said it is coordinating with AT&T, T-Mobile and Verizon to block fraudulent messages and is advocating for seven bipartisan US anti-scam bills, including the Stop SCAMS Act. Whether the seizures durably disrupt the operation will depend on whether its operators rebuild on infrastructure outside US reach.