Hackers Impersonate ChatGPT Subscription Alerts to Steal OpenAI Account Credentials
Cofense reports a phishing campaign using fake ChatGPT subscription payment notices to lure users to credential-harvesting pages and steal OpenAI account logins.
Cofense identified phishing emails impersonating ChatGPT subscription invoices, using the genuine logo, 'Subscription Payment Required' wording, and a 48-hour urgency deadline. Links route through a Google notifications API redirect wrapper to attacker-controlled nxcli[.]io infrastructure hosting a fake ChatGPT login page that forwards submitted credentials to the attackers before showing an error. Cofense published IOCs including sender support@9527db6e1a[.]nxcli[.]io and two stage-2 payload URLs; the operators behind the campaign were not named.
- Emails impersonate 'The OpenAI Team' with real ChatGPT branding and an 'Update Payment Information' button.
- Links use a Google API redirect wrapper to reach attacker-controlled nxcli[.]io infrastructure.
- Fake login page captures OpenAI credentials, then displays an error to victims.
- Cofense published IOCs; MFA, unique passwords, and direct site navigation are recommended defenses.
- Vendors
- OpenAI
- Products
- ChatGPT
- Victims
- ChatGPT users
- Organizations
- Cofense
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 9527db6e1a.nxcli.io | e (IoCs):- Type Indicator Description Email address support@9527db6e1a[.]nxcli[.]io Sender address used in the observed phishing email URL |
| domain | e83cedb076.nxcli.io | 5nZyb_erqo Stage 1 observed email infection URL URL hXXps://e83cedb076[.]nxcli[.]io/fertaq/app/key[.]php Stage 2 observed payload URL URL h |
| domain | notifications.googleapis.com | der address used in the observed phishing email URL hXXps://notifications[.]googleapis[.]com/email/redirect?t=AFG8qyW_Su5pVpWF_Tm7YFcNgju_01zhPKtjCp |
| url | https://e83cedb076.nxcli.io/fertaq/app/key.php | T5E4LWD15nZyb_erqo Stage 1 observed email infection URL URL hXXps://e83cedb076[.]nxcli[.]io/fertaq/app/key[.]php Stage 2 observed payload URL URL hXXps://e83cedb076[. |
| url | https://e83cedb076.nxcli.io/fertaq/app/login.php | [.]io/fertaq/app/key[.]php Stage 2 observed payload URL URL hXXps://e83cedb076[.]nxcli[.]io/fertaq/app/login[.]php Stage 2 observed payload URL Note: IP addresses and d |
| url | https://notifications.googleapis.com/email/redirect?t=AFG8qyW_Su5pVpWF_Tm7YFcNgju_01zhPKtjCpIcIfTVDTsqk_NT5E4LWD15nZyb_erqo | .]io Sender address used in the observed phishing email URL hXXps://notifications[.]googleapis[.]com/email/redirect?t=AFG8qyW_Su5pVpWF_Tm7YFcNgju_01zhPKtjCpIcIfTVDTsqk_NT5E4LWD15nZyb_erqo Stage 1 observed email infection URL URL hXXps://e83ced |
From the original article
3 min read at cybersecuritynews.com
ChatGPT subscription notices have become the latest cover for credential-stealing emails. The campaign uses a familiar billing problem to push recipients toward a fake sign-in page, where attackers can collect OpenAI account details. A successful theft can expose saved conversations and give criminals another identity to abuse in follow-on scams.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.