{“lastseen”:”2025-11-13T16:05:53″,”description”:”A Phishing-as-a-Service (PhaaS) platform based in China, known as \u201cLighthouse,\u201d is the subject of a new Google lawsuit.\\n\\nLighthouse enables smishing (SMS phishing) campaigns, and if you\u2019re in the US there is a good chance you’ve seen their texts about a small amount you supposedly owe in toll fees. Here’s an example of a toll-fee scam text:\\n\\n\\n\\nGoogle’s lawsuit brings claims against the Lighthouse platform under federal racketeering and fraud statutes, including the Racketeer Influenced and Corrupt Organizations Act (RICO), the Lanham Act, and the Computer Fraud and Abuse Act.\\n\\nThe texts lure targets to websites that impersonate toll authorities or other trusted organizations. The goal is to steal personal information and credit card numbers for use in further financial fraud.\\n\\nAs we reported in October 2025, Project Red Hook launched to combine the power of the US Homeland Security Investigations (HSI), law enforcement partners, and businesses to raise awareness of how Chinese organized crime groups use gift cards to launder money.\\n\\nThese toll, postage, and refund scams might look different on the surface, but they all feed the same machine, each one crafted to look like an urgent government or service message demanding a small fee. Together, they form an industrialized text-scam ecosystem that\u2019s earned Chinese crime groups more than $1 billion in just three years.\\n\\nGoogle says Lighthouse alone affected more than 1 million victims across 120 countries. A September report by Netcraft discussed two phishing campaigns believed to be associated with Lighthouse and \\”Lucid,\\” a very similar PhaaS platform. Since identifying these campaigns, Netcraft has detected more than 17,500 phishing domains targeting 316 brands from 74 countries.\\n\\nAs grounds for the lawsuit, Google says it found at least 107 phishing website templates that feature its own branding to boost credibility. But a lawsuit can only go so far, and Google says robust public policy is needed to address the broader threat of scams:\\n\\n\\u003e \u201cWe are collaborating with policymakers and are today announcing our endorsement of key bipartisan bills in the U.S. Congress.\u201d\\n\\nWill lawsuits, disruptions, and even bills make toll-fee scams go away? Not very likely. The only thing that will really help is if their source of income dries up because people stop falling for smishing. Education is the biggest lever. \\n\\n## Red flags in smishing messages\\n\\nThere are some tell-tale signs in these scams to look for:\\n\\n 1. **Spelling and grammar mistakes** : the scammers seem to have problems with formatting dates. For example \u201cSeptember 10nd\u201d, \u201c9st\u201d (instead of 9th or 1st).\\n 2. **Urgency:** you only have one or two days to pay. Or else\u2026\\n 3. **The over-the-top threats:** Real agencies won\u2019t say your \u201ccredit score will be affected\u201d for an unpaid traffic violation.\\n 4. **Made-up legal codes:** \u201cOhio Administrative Code 15C-16.003\u201d doesn\u2019t match any real Ohio BMV administrative codes. When a code looks fake, it probably is!\\n 5. **Sketchy payment link:** Truly trusted organizations don\u2019t send urgent \u201cpay now or else\u201d links by text.\\n 6. **Vague or missing personalization:** Genuine government agencies tend to use your legal name, not a generic scare message sent to many people at the same time.\\n\\n\\n\\n## Be alert to scams\\n\\nRecognizing scams is the most important part of protecting yourself, so always consider these golden rules:\\n\\n * Always search phone numbers and email addresses to look for associations with known scams.\\n * When in doubt, go directly to the website of the organization that contacted you to see if there are any messages for you.\\n * Do not get rushed into decisions without thinking them through.\\n * Do not click on links in unsolicited text messages.\\n * Do not reply, even if the text message explicitly tells you to do so.\\n\\n\\n\\nIf you have engaged with the scammers\u2019 website:\\n\\n * Immediately change your passwords for any accounts that may have been compromised. \\n * Contact your bank or financial institution to report the incident and take any necessary steps to protect your accounts, such as freezing them or monitoring for suspicious activity. \\n * Consider a fraud alert or credit freeze. To start layering protection, you might want to place a fraud alert or credit freeze on your credit file with all three of the primary credit bureaus. This makes it harder for fraudsters to open new accounts in your name.\\n * US citizens can report confirmed cases of identity theft to the FTC at identitytheft.gov.\\n\\n\\n\\n**Pro tip:** You can upload suspicious messages of any kind to Malwarebytes Scam Guard. It will tell you whether it\u2019s likely to be a scam and advise you what to do.\\n\\n* * *\\n\\n**We don ‘t just report on scams\u2014we help detect them**\\n\\nCybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard, a feature of our mobile protection products. Submit a screenshot, paste suspicious content, or share a text or phone number, and we\u2019ll tell you if it’s a scam or legit. Download Malwarebytes Mobile Security for iOS or Android and try it today!”,”published”:”2025-11-13T14:43:06″,”modified”:”2025-11-13T14:43:06″,”type”:”malwarebytes”,”title”:”1 million victims, 17,500 fake sites: Google takes on toll-fee scammers”,”source”:””,”references”:””,”id”:”MALWAREBYTES:8EFE16B482DD5C1E535E09E6DE07A0AD”,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/news\/2025\/11\/1-million-victims-17500-fake-sites-google-takes-on-toll-fee-scammers”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-13T16:05:53″,”description”:”A Phishing-as-a-Service (PhaaS) platform based in China, known as \u201cLighthouse,\u201d is the subject of a new Google lawsuit.\\n\\nLighthouse enables smishing (SMS phishing) campaigns, and if…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-26120","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n