Outsider Enterprise
Last changed 2026-10-27 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Why this score
| Every page starts at | 65 |
| The subject's own conduct | -196 |
| Sum | -131 |
- The page establishes that the subject is itself a scheme, so the score is 0.
Score: 0/100 (kept between 0 and 100)
How scoring works →Page reliability: Fact-checked 2026-10-27 · 7 of 10 claims confirmed · 3 need better sources
anchored·4Ww7RQ…Cmc1Summary
Outsider Enterprise is a China-based phishing-as-a-service operation, attributed by researchers to a threat actor known as ChenLun, that sold subscription-based phishing kits through a Telegram bot since at least July 2023. On June 12, 2026, Google filed a civil RICO and Lanham Act lawsuit against 25 Doe defendants (case No. 1:26-cv-04982-VM, S.D.N.Y.), and the FBI announced Operation Ghost Hook the following day, seizing domains and approximately $100,000 from the operation's payment wallets. The FBI's Cyber Division has linked the platform to an estimated $1.9 billion in losses and approximately 3.87 million compromised payment card numbers; post-takedown research published September 3, 2026 found the affiliate network remained active with over 700 new phishing domains identified after the enforcement action.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(7 events)
1 July 2023
Outsider Enterprise phishing-as-a-service platform begins operating, per FBI Cyber Division attribution linking losses to this date.
CyberScoop / FBI statement1 December 2025
Group-IB begins tracking Outsider phishing pages at scale; over 100,000 phishing pages identified between December 2025 and May 2026 across 54+ countries.
Group-IB Blog18 May 2026
Two-week period begins (May 18–June 1) during which Google data shows 2.5 million fraudulent SMS messages sent to Android users; 55,000 flagged as spam.
The Hacker News / Google complaint data12 June 2026
Google files civil RICO and Lanham Act lawsuit against 25 Doe defendants (case No. 1:26-cv-04982-VM) in the Southern District of New York. Google General Counsel Halimah DeLaine Prado announces the action publicly.
TechCrunch / SecurityWeek13 June 2026
FBI Cyber Division announces Operation Ghost Hook, seizing Outsider's core admin server domains, a Shopify storefront, approximately $100,000 from payment wallets, and thousands of phishing domains through U.S. providers. Action conducted jointly with Google and Lumen Technologies' Black Lotus Labs.
CyberScoop / SecurityWeek13 June 2026
Outsider Telegram bot (@OutsiderCodeBot) becomes inaccessible following enforcement actions. ChenLun deletes the primary Telegram channel.
The Hacker News3 September 2026
Group-IB publishes research finding that over 700 new phishing domains associated with the Outsider kit have been created since the June takedown, indicating the affiliate network remained operational despite loss of central infrastructure.
Infosecurity Magazine / Group-IBDecision Log
- slot 462182075 · hash H5Q7GD54h2kzgBoZPmqwrJMaSAsndQThZ5uqMGj7bMax
- slot 462182070 · hash 7UDkxqvaZCBbdYTvP3sgGTWHkBVNZwFnhNxBRN3i6UB5
- slot 461962374 · hash 3QDsQJdjf2VAL8QZibTXS1hFGDdcfpLSg6pidqVDKSEY
- slot 447245527 · hash AtWA3gdhMdeau4vJe5Ua1B3qYUyKDva5jAvji4UFTfJQ
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 11 of 11 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/15/2026, 12:04:24 PM
last updated: 10/27/2026, 7:03:12 PM
6 viewsavoid.net — verified advice for a post-truth world