ChatGPT Phishing Campaign Targets Both Work and Personal OpenAI Accounts
Cofense identified a phishing campaign impersonating ChatGPT billing notices to steal OpenAI credentials and payment data via fake login pages hosted on nxcli.io.
Cofense's Phishing Defense Center observed emails posing as OpenAI subscription payment notices with a 48-hour deadline, sent from support@9527db6e1a[.]nxcli[.]io. Links route through notifications[.]googleapis[.]com redirect wrappers to credential-harvesting pages on e83cedb076[.]nxcli[.]io that closely mimic the ChatGPT login interface. After credentials are submitted, victims see an error page while attackers capture data that can expose account history, API usage, payment details, and sensitive prompts.
- Emails pose as ChatGPT subscription payment notices with a 48-hour urgency deadline
- Sender support@9527db6e1a[.]nxcli[.]io is not an OpenAI domain
- Links redirect via notifications.googleapis.com to phishing pages on nxcli[.]io
- Fake page mimics ChatGPT authentication and captures submitted credentials
- Stolen credentials can expose API keys, prompts, files, and payment data
- Products
- ChatGPT
- Organizations
- Cofense Phishing Defense Center
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 9527db6e1a.nxcli.io | fraud. Cofense observed the email originating from support@9527db6e1a[.]nxcli[.]io , rather than a domain associated with OpenAI. The embe |
| domain | auth.openai.com | uthentication flows to use official OpenAI domains, such as auth[.]openai[.]com . In the campaign documented by Cofense, the phishing d |
| domain | e83cedb076.nxcli.io | [.]io subdomain, with observed phishing endpoints including e83cedb076[.]nxcli[.]io/fertaq/app/key[.]php and e83cedb076[.]nxcli[.]io/fertaq |
| domain | notifications.googleapis.com | etection. The first-stage URL observed in the campaign uses notifications[.]googleapis[.]com/email/redirect , followed by a lengthy redirect paramet |
| domain | nxcli.io | tGPT Phishing Campaign The eventual payload is hosted on an nxcli[.]io subdomain, with observed phishing endpoints including e83 |
From the original article
3 min read at gbhackers.com
Threat actors are increasingly impersonating OpenAI’s ChatGPT service in credential-phishing campaigns, exploiting the growing use of generative AI across both enterprise and personal environments. A recently observed campaign uses a fraudulent subscription-payment notice to lure victims into disclosing OpenAI account credentials and potentially payment details through a convincing fake ChatGPT login page.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.