Fake ChatGPT billing emails are stealing accounts

A fake ChatGPT billing email is stealing accounts. It is, in fact, a phishing attack designed to harvest login and payment information. Researchers at security firm Cofense have identified a phishing campaign impersonating OpenAI and ChatGPT. The fraudulent email appears to be a subscription payment notice and uses the official ChatGPT logo to look authentic.

The biggest giveaway is the sender address. The phishing emails Cofense examined were sent from support@9527db6e1a[.]nxcli[.]io — a domain with no connection to OpenAI. OpenAI says its customer communications come from official domains such as @openai.com, @mail.openai.com, and @email.openai.com. Checking the sender address is therefore enough to spot the fake email.

Cofense's analysis found that clicking the 'Update payment information' button takes victims to a convincing fake page that closely mimics the real ChatGPT login page. The goal of the campaign is to steal account credentials and payment details there.