Fake ChatGPT Billing Email Steals OpenAI Login Credentials
Summary
Cofense reports a fake ChatGPT billing email that sends users through a Google redirect to a counterfeit login page, which captures entered credentials. It advises checking for auth[.]openai[.]com before signing in.
Key points
- The email impersonates ChatGPT, using a payment warning, a $23.80 balance and a 48-hour deadline to pressure recipients to click.
- The payment button redirects through notifications[.]googleapis[.]com to a phishing page hosted on nxcli[.]io.
- The counterfeit page captures usernames and passwords, then sends victims to an error page.
- Cofense advises checking that the address bar shows auth[.]openai[.]com before entering credentials.
- Cofense lists the redirect link and the nxcli[.]io paths login.php and key.php as indicators for mail teams to search and block.
Article Details
- Event Type
- Credential-phishing campaign impersonating ChatGPT and OpenAI billing.
- Impact
- The counterfeit login page captures usernames and passwords entered by victims and then redirects them to an error page. The lure targets ChatGPT users on work and personal accounts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 9527db6e1a[.]nxcli[.]io | Phishing email sender host identified by Cofense and associated with the counterfeit login page. |
| HOSTNAME | 9527db6e1a[.]nxcli[.]io | Attacker-associated host serving the credential-phishing pages. |