Google has filed a lawsuit to dismantle "Lighthouse", a phishing-as-a-service (PhaaS) platform used by cybercriminals worldwide to steal credit card information through SMS phishing ("smishing") attacks that impersonate the U.S. Postal Service (USPS) and E-ZPass toll systems.
The lawsuit aims to shut down the website infrastructure supporting the Lighthouse phishing-as-a-service (PhaaS), which Google says has affected over 1 million victims across 120 countries. It is estimated that these types of scams have stolen up to 115 million payment cards in the U.S. alone between July 2023 and October 2024 using these scams.
Google's lawsuit has brought claims against the Lighthouse platform under federal racketeering and fraud statutes, including the Racketeer Influenced and Corrupt Organizations Act, Lanham Act, and the Computer Fraud and Abuse Act.
Lighthouse PhaaS used in toll and delivery scams
According to Google, Lighthouse offers phishing templates and infrastructure to other cybercriminals, allowing them to send text messages claiming to be from well-known services like USPS or toll payment systems like EZPass.
BleepingComputer has previously reported on such scams after massive phishing campaigns targeted people in the United States, claiming to be from toll authorities.
EZ Pass phishing text
Source: BleepingComputer
The links in these smishing texts point to sites that impersonate toll authorities that claim the visitor has unsettled toll charges. However, the main goal of these sites is to steal personal information and credit card numbers for use in additional financial fraud.
The phishing page victims land on
... continue reading