Google sues Chinese cybercriminal group over alleged phishing

Google has filed a lawsuit against a group it calls “Darcula,” accusing the alleged Chinese cybercriminals of running a large-scale phishing operation targeting Americans.

The lawsuit claims the group used a software kit to send mass text messages posing as offers for free Google services, including YouTube Premium, to trick recipients into providing credit card details.

Google alleges that nearly 900,000 credit card numbers were stolen over seven months, with 40,000 belonging to US residents.

The group is said to have included around 600 members at its peak, and was reportedly responsible for up to 80% of phishing messages during the period.

The suit also states that Darcula’s latest tools use AI to quickly generate fake websites for scams.

The complaint was filed on December 17, 2025 in the US.

🔗 Source: Bloomberg

🧠 Food for thought

Implications, context, and why it matters.

Google seeks seizure of Darcula infrastructure

Google seeks a temporary restraining order (a short-term court order) to seize and shut down Darcula’s web infrastructure 1, aiming to disrupt operations by taking control of phishing sites and domains.
Enforcement is hard because the complaint names Yucheng Chang in China plus 24 unnamed defendants abroad 2, so limited U.S. law-enforcement cooperation could hinder seizures or prosecution even if Google wins 2.
Outcomes hinge on whether U.S. courts force registrars (companies that manage domain names) and hosting providers (firms that run websites) to surrender Darcula infrastructure 3. Netcraft links infrastructure to Cloudflare (a web infrastructure and security provider) on 32% of pages with Tencent (a Chinese tech company), Quadranet and Multacom (U.S.-based hosting providers) in use 3.

Vendors see openings as tactics surface

Google estimates Darcula drove 80% of phishing texts earlier this year, with the group and associates stealing nearly 900,000 credit card numbers, about 40,000 from Americans 1.
Security vendors can stand out by tackling encrypted iMessage (Apple’s messaging service) and Rich Communication Services (RCS) traffic that bypasses SMS firewalls (carrier text-message filtering) 3. Darcula also uses redirects that divert scanners 3 and AI added in April 2025 for multi-language phishing with automated form generation 4.
Netcraft (an internet security company) has blocked over 90,000 Darcula domains and taken down over 20,000 fake sites since March 2024 5. Brands hit by Phishing-as-a-Service platforms (subscription toolkits that let non-experts run phishing campaigns) want detection and automated takedowns.