Fake ChatGPT Billing Emails Target OpenAI Credentials
A phishing campaign is impersonating ChatGPT billing notifications to trick users into revealing their OpenAI account credentials.
Cybercriminals are employing a sophisticated phishing campaign that leverages fake ChatGPT billing emails to harvest OpenAI credentials. The fraudulent emails are designed to mimic legitimate payment notifications, creating a sense of urgency and prompting recipients to act quickly.
The phishing emails, which arrive with subjects like "Urgent: Update Your Payment Method to Avoid Service Interruption," feature the ChatGPT logo and a fabricated outstanding balance of $23.80. They warn users that their account may be suspended if billing information is not updated within 48 hours, a common tactic to bypass critical thinking. A prominent green button labeled "Update Payment Information" is the primary call to action, designed to lead unsuspecting users directly into the attackers' trap.
While the emails appear convincing at first glance, a closer inspection reveals tell-tale signs of a phishing attempt. The sender's email address, support@9527db6e1a[.]nxcli[.]io, is a clear indicator that it does not originate from OpenAI. Security researchers also noted that the "Update Payment Information" button does not link directly to a malicious site but instead uses a Google redirect through notifications[.]googleapis[.]com. This redirection complicates immediate detection, as users might initially see a legitimate-looking Google URL before being forwarded to the attacker's domain.
Upon clicking the link, users are directed to a fake OpenAI login page that closely resembles the legitimate authentication portal. This page features the ChatGPT logo and a "Welcome back" greeting, further enhancing the illusion of legitimacy. However, the actual sign-in page for OpenAI resides at auth.openai.com. Any username and password entered into the fraudulent page are captured by the attackers, compromising the user's OpenAI account. After credential submission, victims are typically redirected to an error page, leaving them unaware that their information has been stolen.
This campaign is notable for its broad targeting, affecting both work and personal ChatGPT accounts. The attackers aim to capture credentials that could grant them access to sensitive data, potentially disrupt services, or be used for further malicious activities. The use of a Google redirect, while a potential giveaway for those who scrutinize links, also serves to bypass some basic email security filters that might flag direct links to known malicious domains.
Security researchers at Cofense have identified key indicators for detection, including the Google redirect link and specific paths on the attacker's domain (login.php and key.php on the nxcli[.]io host). Mail administrators are advised to search their logs for these indicators to identify and block the campaign. For end-users, the most crucial step is to always verify the URL in the address bar before entering any credentials, ensuring it is the legitimate auth.openai.com domain.
The campaign underscores the persistent threat of phishing attacks, which continue to evolve with more sophisticated lures and technical obfuscation. As AI tools become more accessible, the creation of convincing fake emails and landing pages is becoming easier for threat actors, making user vigilance and robust security awareness training more critical than ever.