Phishers Impersonate OpenAI to Steal ChatGPT Billing Info
Original title: Hackers Exploit ChatGPT’s Popularity With Fake Billing Notices That Target Credit Cards and OTPs
Fake ChatGPT Plus billing emails use live operators and fake checkouts to capture card details and OTPs; Fortra researchers observed the infrastructure.
Hackers sent emails posing as OpenAI payment notices claiming subscription failures. Recipients were directed to fake checkout pages on short-lived WordPress sites that collected card information and displayed indefinite loading while an operator controlled responses. The campaign targeted ChatGPT users to steal financial details and verification codes. Researchers from Fortra documented the operation without observing malware deployment.
Unconfirmed: Whether attackers purchased hosting accounts themselves or compromised existing customer sites remains unresolved.
- Emails urge update of billing information
- Checkout page keeps spinner running indefinitely
- Operator can redirect to OTP capture page
- Same client-side code reused across sites
- Sites disappear and are replaced
Impact: stolen credit card details and one-time passwords
- 1.Verify billing through account instead of email link
- 2.Report fraudulent hosting
- 3.Check for matching messages
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 188f0289b4.nxcli.io | dditional hosts 0c859d4565.nxcli.io , c7958246e7.nxcli.io , 188f0289b4.nxcli.io Offline host 5fceac40bf.nxcli.io Redirect domains authgpt.i |
| domain | 5fceac40bf.nxcli.io | io , c7958246e7.nxcli.io , 188f0289b4.nxcli.io Offline host 5fceac40bf.nxcli.io Redirect domains authgpt.info , ai-billing.info , mub.me , |
| domain | ai-billing.info | ne host 5fceac40bf.nxcli.io Redirect domains authgpt.info , ai-billing.info , mub.me , url-y.uk Landing pattern https://<10-char-hex>.n |
| domain | authgpt.info | .nxcli.io Offline host 5fceac40bf.nxcli.io Redirect domains authgpt.info , ai-billing.info , mub.me , url-y.uk Landing pattern https |
| domain | c54b986c1c.nxcli.io | :- Indicator type Source-reported value Confirmed host / IP c54b986c1c.nxcli.io / 209.87.159.240 Confirmed host / IP 0b8918640c.nxcli.io / |
| domain | mub.me | .nxcli.io Redirect domains authgpt.info , ai-billing.info , mub.me , url-y.uk Landing pattern https://<10-char-hex>.nxcli.io/w |
| domain | url-y.uk | Redirect domains authgpt.info , ai-billing.info , mub.me , url-y.uk Landing pattern https://<10-char-hex>.nxcli.io/wp-admin/<ra |
| ipv4 | 209.87.159.240 | ce-reported value Confirmed host / IP c54b986c1c.nxcli.io / 209.87.159.240 Confirmed host / IP 0b8918640c.nxcli.io / 209.87.159.83 Add |
| ipv4 | 209.87.159.83 | / 209.87.159.240 Confirmed host / IP 0b8918640c.nxcli.io / 209.87.159.83 Additional hosts 581c413572.nxcli.io , 58f9d9ca90.nxcli.io |
| sha1 | 1834f733528e1a9fc930069fa3763a2809d41769 | point ../panel/classes/processor.php Application identifier 1834f733528e1a9fc930069fa3763a2809d41769 Card-form fields cddd , bebeb , gagaga , byebu Polling para |
From the original article
3 min read at cybersecuritynews.com
Hackers are impersonating OpenAI in fake ChatGPT Plus billing emails that lead users to payment pages designed to steal credit card details and one-time passwords. The campaign combines convincing subscription warnings with a live operator who can decide when to request a verification code, potentially helping approve an unauthorized payment. The emails claim a subscription […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.