Skip to content
NewA calmer, faster ZeroHour
StoryPhishing & fraudhighExploited in the wild

Fake ChatGPT Billing Emails Steal Cards and OTPs on Rotating Sites

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Hackers use fake ChatGPT Plus emails to direct users to interactive phishing sites on nxcli.io that capture card details and OTPs via live operators.

Hackers sent emails impersonating OpenAI payment notices claiming ChatGPT Plus subscription failures. Victims were directed to rotating WordPress sites on nxcli.io hosting fake checkouts that collected card information while an operator controlled responses in real time, including redirects to OTP capture pages. Fortra and GBHackers documented the infrastructure without observing malware. OpenAI advised users to verify notices directly and contact banks for unauthorized charges.

Key facts
  • Emails claim ChatGPT subscription failure
  • Interactive phishing on nxcli.io WordPress sites
  • Operator polls backend every 500ms
  • Card details and OTPs captured in real time
  • Sites rotate without rebuilding
  • OpenAI warns against fake billing notices
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 2, 2026Phishing campaign observed · Cyber Security News, GBHackers

What each outlet adds

beyond the shared facts
  • Cyber Security NewsFortra documented operation without malware
  • GBHackersRotating sites with 500ms polling for operator control
Vendors
OpenAI
Products
ChatGPT
Victims
ChatGPT users
Organizations
Nexcess

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Cyber Security NewsFirst report

    Phishers Impersonate OpenAI to Steal ChatGPT Billing Info

    Fake ChatGPT Plus billing emails use live operators and fake checkouts to capture card details and OTPs; Fortra researchers observed the infrastructure.

  2. · 1d ago GBHackers

    ChatGPT Phishing Kit Uses Rotating WordPress Websites to Steal Payment Details and OTPs

    Fraudulent ChatGPT Plus billing emails direct victims to interactive phishing pages on nxcli.io that collect card details and allow operators to capture OTPs in real time.