Hackers Impersonate OpenAI with Fake ChatGPT Billing Emails to Steal Financial Data
A sophisticated phishing campaign is impersonating OpenAI, using fake ChatGPT Plus billing notices to trick users into revealing credit card details and one-time passwords.
Cybercriminals are leveraging the popularity of OpenAI's ChatGPT by sending out convincing phishing emails that mimic official billing notifications. These emails aim to trick users into updating their payment information, ultimately leading to the theft of sensitive financial data, including credit card numbers and one-time passwords (OTPs).
The attack begins with an email that falsely claims a ChatGPT Plus subscription payment has failed, urging recipients to update their billing details to avoid service interruption. This tactic preys on users' desire to maintain access to popular AI services and creates a sense of urgency. The emails contain links that, after passing through tracking services or redirect wrappers, lead to a fake checkout page hosted on short-lived WordPress instances.
Researchers from Fortra identified this phishing operation and noted its reliance on social engineering rather than malware deployment. The fake checkout page is designed to look legitimate, mimicking real payment forms by recognizing card brands and formatting card numbers, expiration dates, and security codes as users input them. Once the user submits their details, the captured information—card number, expiration date, security code, and cardholder name—is sent to the attacker's server.
A key element of this campaign is the use of a live operator. After the victim submits their payment information, the fake checkout page displays an indefinite loading animation. This is not a technical glitch but a deliberate tactic to keep the victim engaged while a human attacker monitors the session. The browser repeatedly contacts an operator dashboard, allowing the attacker to decide the next step.
The operator can then choose to redirect the victim to a page designed to capture OTPs, display a fabricated error message, or simply end the session. This real-time interaction allows attackers to intercept verification codes sent by banks to authorize fraudulent transactions. While the capture of an OTP is crucial for authorizing payments, Fortra clarified that not every submission results in a successful transaction.
The infrastructure used in this campaign is designed for rapid deployment and evasion. The fake sites are hosted on short-lived WordPress instances, and the same landing page is often reused across multiple recipients within a single sending wave, indicating shared infrastructure. The sites frequently disappear and are replaced, complicating investigation and takedown efforts. Fortra observed identical client-side code and a shared application identifier across different deployed sites, suggesting a consistent operational framework.
Defenders are advised to look for recurring page structures and suspicious dashboard traffic, which can serve as stronger indicators of compromise than isolated IP addresses or domains. Broader live financial phishing operations underscore the critical need for users to verify billing information directly through their account portals rather than relying on email links. Organizations should also monitor for suspicious hosting and report fraudulent infrastructure to aid in disruption efforts, while being mindful of not blocking legitimate customer traffic.
This campaign highlights the evolving tactics of cybercriminals who are adept at exploiting the trust and widespread adoption of popular AI services like ChatGPT. By combining convincing phishing lures with interactive elements and a human operator, attackers are creating sophisticated schemes to harvest financial data and potentially commit fraud.