November 12, 2025 – Google has filed a lawsuit against a cybercriminal group behind massive text phishing scams that impersonated trusted brands like E-ZPass and the U.S. Postal Service.
The case highlights the growing threat of “smishing” attacks, which trick users into clicking fraudulent links and sharing sensitive financial information.
The lawsuit aims to dismantle the group’s phishing infrastructure and protect millions of users worldwide.
Google Sues Cybercriminal Group Behind E-ZPass Scam
The cybercrime syndicate, often referred to as the “Smishing Triad,” allegedly used a phishing-as-a-service kit called Lighthouse to launch large-scale attacks.
According to Google, the group targeted more than one million victims across 120 countries, creating fake websites that mimicked toll services, postal agencies, and even Google itself.
These fraudulent sites collected credit card details, banking information, and personal data from unsuspecting users.
USPS Text Phishing Scams and Global Impact
Meanwhile, the same group exploited USPS branding to send fake delivery notifications. Victims were asked to pay small fees or provide login credentials, which were then stolen.
Reports suggest that between 12.7 million and 115 million credit cards in the U.S. may have been compromised through these scams.
Google’s general counsel Halimah DeLaine Prado explained, “They were preying on users’ trust in reputable brands such as E-ZPass, the U.S. Postal Service, and even us as Google.”
Legal Action and Industry Response
Google filed the lawsuit in the U.S. District Court for the Southern District of New York, seeking to shut down the Lighthouse platform and prevent future attacks.
According to CNBC News, the company believes this legal move will disrupt the phishing-as-a-service model that enables inexperienced scammers to launch sophisticated campaigns.
Industry experts note that such lawsuits are critical to deterring organized cybercrime and safeguarding digital ecosystems.