Cybersecurity researchers at CyberGuy have highlighted a sophisticated phishing campaign uncovered by the Cofense Phishing Defense Center. The operation specifically targets subscribers of ChatGPT, exploiting routine subscription management to steal sensitive account credentials and payment information. The malicious emails are designed to look like authentic customer service notices from OpenAI, leveraging official branding, logos, and urgent language to pressure recipients into acting without verification.
Anatomy of the ChatGPT Billing Scam
According to the security advisory, the deceptive messages prominently display notices warning that a subscription payment requires immediate attention. The emails assert that users have a strict 48-hour window to resolve the issue before their access is interrupted. This artificial pressure is intended to catch users off guard during busy workdays or while browsing on mobile devices, prompting them to click an embedded “Update Payment Information” button.
Deceptive Redirects and Phishing Infrastructure
Security analysis reveals that the attackers employ technical workarounds to obscure their malicious destination. When a recipient clicks the payment button in the email, the link routes them through a Google API redirect before forwarding them to the ultimate phishing domain. This intermediate step can temporarily display familiar Google domains in the URL path, lending an unearned sense of legitimacy to the link before the browser lands on the attacker’s controlled site.
Further investigation into the sender addresses by Fox News indicates that the messages originate from domains entirely unrelated to OpenAI, such as support@9527db6e1a[.]nxcli[.]io. OpenAI currently routes legitimate customer communications through verified domains including @openai.com, @mail.openai.com, and @email.openai.com. Security experts emphasize that relying on the display name in an inbox is insufficient, as attackers routinely spoof sender names while leaving suspicious underlying infrastructure exposed.
The Fake Login Portal and Stolen Credentials
Once victims traverse the redirect chain, they arrive at a counterfeit login portal that meticulously mirrors the official ChatGPT authentication interface. The page replicates official icons, fonts, and layout structures to convince users they are interacting with genuine OpenAI infrastructure. If an unsuspecting subscriber enters their login credentials, the page captures the input and immediately forwards the data to the malicious operators.
Following credential capture, the fraudulent site typically routes the user to a generic error screen, simulating a temporary technical glitch or session timeout. By the time the victim realizes the interruption is artificial, the attackers have already harvested their login details. OpenAI officials have not yet issued a formal public statement regarding this specific threat vector, leaving account holders responsible for verifying their security posture independently.
Recommended Mitigation and Security Measures
Cybersecurity analysts advise users who suspect they have received or interacted with these fraudulent billing notices to take immediate corrective action. Subscribers should completely bypass email links when addressing account discrepancies, navigating directly to official platforms via ChatGPT.com or authorized mobile applications. Account holders should verify their active login sessions under security settings and terminate any unrecognized device connections.
For individuals who entered payment card details into the fraudulent interface, contacting financial institutions immediately to request card replacement remains critical. Furthermore, security professionals urge all users to enable multi-factor authentication (MFA) across their accounts and maintain unique passwords supported by a password manager to limit the scope of potential credential exposure.