Outsider Enterprise
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4Ww7RQ…Cmc1Summary
Outsider Enterprise is a China-based phishing-as-a-service operation, attributed by researchers to a threat actor known as ChenLun, that sold subscription-based phishing kits through a Telegram bot since at least July 2023. On June 12, 2026, Google filed a civil RICO and Lanham Act lawsuit against 25 Doe defendants (case No. 1:26-cv-04982-VM, S.D.N.Y.), and the FBI announced Operation Ghost Hook the following day, seizing domains and approximately $100,000 from the operation's payment wallets. The FBI's Cyber Division has linked the platform to an estimated $1.9 billion in losses and approximately 3.87 million compromised payment card numbers; post-takedown research published September 3, 2026 found the affiliate network remained active with over 700 new phishing domains identified after the enforcement action.
Connected Entities
1 entities · 10 linked investigationsTimeline(7 events)
1 July 2023
Outsider Enterprise phishing-as-a-service platform begins operating, per FBI Cyber Division attribution linking losses to this date.
CyberScoop / FBI statement1 December 2025
Group-IB begins tracking Outsider phishing pages at scale; over 100,000 phishing pages identified between December 2025 and May 2026 across 54+ countries.
Group-IB Blog18 May 2026
Two-week period begins (May 18–June 1) during which Google data shows 2.5 million fraudulent SMS messages sent to Android users; 55,000 flagged as spam.
The Hacker News / Google complaint data12 June 2026
Google files civil RICO and Lanham Act lawsuit against 25 Doe defendants (case No. 1:26-cv-04982-VM) in the Southern District of New York. Google General Counsel Halimah DeLaine Prado announces the action publicly.
TechCrunch / SecurityWeek13 June 2026
FBI Cyber Division announces Operation Ghost Hook, seizing Outsider's core admin server domains, a Shopify storefront, approximately $100,000 from payment wallets, and thousands of phishing domains through U.S. providers. Action conducted jointly with Google and Lumen Technologies' Black Lotus Labs.
CyberScoop / SecurityWeek13 June 2026
Outsider Telegram bot (@OutsiderCodeBot) becomes inaccessible following enforcement actions. ChenLun deletes the primary Telegram channel.
The Hacker News3 September 2026
Group-IB publishes research finding that over 700 new phishing domains associated with the Outsider kit have been created since the June takedown, indicating the affiliate network remained operational despite loss of central infrastructure.
Infosecurity Magazine / Group-IBDecision Log
- hash: AtWA3gdhMdeau4vJe5Ua1B3qYUyKDva5jAvji4UFTfJQ
This investigation is cryptographically anchored to the Solana blockchain (1 event). 11 of 11 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/15/2026, 12:04:24 PM
last updated: 9/16/2026, 12:12:20 AM
avoid.net — verified advice for a post-truth world