Loading threat actor…
Outsider Enterprise is a China-based, Chinese-speaking phishing-as-a-service criminal operation that provides turnkey infrastructure, templates, and operator support for large-scale smishing and phishing campaigns. The group coordinates heavily through Telegram and lowers the barrier to entry for affiliates and other fraud actors by offering subscription access to phishing kits, prebuilt brand impersonation templates, and guidance for running fraudulent text-message campaigns and fake websites. The operation is associated with The Outsider phishing platform and has been linked to real-time, operator-driven phishing workflows that capture victim input as it is entered, including credentials, payment card data, one-time passcodes, and other personal information. Reporting also links a related framework, JWR, to The Outsider platform with medium confidence based on substantial code and functional overlap. These frameworks support live session monitoring and steering, allowing operators to push victims through staged verification flows, request MFA codes or app approvals, and exfiltrate data in real time. Observed lures have included unpaid tolls, delivery and postal notices, banking alerts, parking violations, and account-security themes, with impersonation of technology brands, financial institutions, telecom providers, government entities, postal services, and toll systems. Outsider Enterprise has also been accused of incorporating generative AI into its fraud ecosystem by instructing customers how to use AI tools, including Gemini, to generate phishing-page code and expand scam-page variations beyond its existing template library. The group’s activity has been tied to thousands of phishing sites, large volumes of scam text messages, widespread theft of payment card data and credentials, and substantial global financial losses. Law-enforcement and industry disruption actions have targeted its infrastructure, payment mechanisms, and administrative assets, but the actor is best characterized as a financially motivated cybercrime service provider enabling broad downstream fraud rather than a state-directed espionage actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Chinese-speaking phishing-as-a-service operator associated with The Outsider platform; the content links JWR as a likely variant and notes Outsider had been operating since 2023 until an FBI technical takedown in 2026.
Operates The Outsider phishing-as-a-service platform; referenced here because JWR is assessed as a likely variant sharing code and functionality with that platform.
A phishing-as-a-service group operating via Telegram that allegedly used Google Gemini to help create phishing websites impersonating Google, YouTube, and government agencies, and offered hundreds of scam templates.
Mentioned only in a related-content link about a phishing service; not part of the Chrome vulnerability article itself.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.