A fake ChatGPT billing email is after your OpenAI password
Cofense reports a fake ChatGPT billing email harvesting OpenAI credentials via a Google redirect to a spoofed login page.
Cofense's Phishing Defense Center traced a fake ChatGPT billing email, sent from support@9527db6e1a[.]nxcli[.]io, claiming a $23.80 overdue balance and a 48-hour deadline before account suspension. The 'Update Payment Information' button routes through a notifications[.]googleapis[.]com redirect to a spoofed OpenAI login page that captures credentials and sends victims to an error page. Cofense published indicators including the Google redirect link plus login.php and key.php paths on the nxcli[.]io host.
- Email spoofs ChatGPT billing with $23.80 balance and 48-hour suspension deadline
- Button uses notifications[.]googleapis[.]com redirect, so hover checks reveal a Google URL
- Fake 'Welcome back' page captures credentials, then sends victims to an error page
- Indicators include login.php and key.php paths on the nxcli[.]io host
- Products
- ChatGPT
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 9527db6e1a.nxcli.io | he From line is where it falls apart. It comes from support@9527db6e1a[.]nxcli[.]io, which is not an OpenAI address. The link runs through |
| domain | notifications.googleapis.com | s not link to the phishing site directly. Its URL starts at notifications[.]googleapis[.]com, a Google API redirect that forwards the browser to the |
| domain | nxcli.io | icators: the Google redirect link and two paths on the same nxcli[.]io host, login.php and key.php. Mail teams can search their |
From the original article
2 min read at helpnetsecurity.com
A fake ChatGPT billing email is steering users to a copy of the OpenAI login page that keeps whatever username and password they type. Josh Varden of Cofense’s Phishing Defense Center traced the email’s payment button through a Google redirect to the attacker’s page. The lure targets ChatGPT users on work and personal accounts alike, and it copies the kind of bill a subscriber already expects.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.