ChatGPT Phishing Kit Uses Rotating WordPress Websites to Steal Payment Details and OTPs
Original title: New ChatGPT Phishing Kit Uses Rotating WordPress Websites to Steal Payment Details and OTPs
Fraudulent ChatGPT Plus billing emails direct victims to interactive phishing pages on nxcli.io that collect card details and allow operators to capture OTPs in real time.
A phishing campaign impersonating OpenAI uses disposable WordPress websites hosted on randomly generated nxcli.io subdomains to steal payment card details and potentially one-time passwords. Counterfeit checkout pages capture card information while an operator-controlled backend allows moving victims to OTP collection pages or terminating sessions. The kit rotates landing pages without rebuilding infrastructure, observed across instances captured a week apart.
Unconfirmed: Whether attackers provisioned hosting accounts themselves or compromised existing customer websites remains unresolved.
- Identical payment forms and obfuscated fields seen on independently deployed sites
- Operator polls processor.php every 500ms to control victim interaction
- Hosting on nxcli.io with token-generating URL segments
- Later frontend changes suggest continued development
- OpenAI advises direct verification and immediate bank contact for unauthorized charges
Impact: Stealing payment card details and one-time passwords for fraudulent transactions
- 1.Verify billing through ChatGPT directly rather than emailed links
- 2.Contact bank immediately if unauthorized charges detected
- 3.Report suspicious activity to official support channels
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | nxcli.io | of a shared template. The landing pages reside on Nexcess’s nxcli.io hosting infrastructure, using randomly generated, ten-chara |
From the original article
2 min read at gbhackers.com
A phishing campaign impersonating OpenAI is using disposable WordPress websites and live attacker oversight to steal payment card details and potentially capture one-time passwords. Fraudulent ChatGPT Plus billing emails warn that subscription payments have failed, directing recipients to counterfeit checkout pages where operators control the victim’s next step.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.