Cybercriminals are making use of OpenAI’s ChatGPT popularity by sending fraudulent billing emails. These messages deceive recipients into visiting fake payment sites that aim to steal sensitive credit card information and one-time passwords.
Deceptive Tactics to Steal User Information
The attackers send emails resembling legitimate ChatGPT Plus subscription alerts, urging users to update their billing details due to alleged payment failures. This tactic preys on the trust users place in well-known brands, similar to other brand impersonation scams targeting financial data.
The fraudulent operation involves a mock checkout page that keeps victims engaged while the attacker controls the flow of events. Researchers from Fortra spotlighted this phishing scheme, noting its infrastructure in a study dated October 26, 2026.
Phishing Infrastructure and Techniques
The operation starts with an email mimicking an OpenAI payment notification. Links within these emails direct users through tracking services to fake checkout sites hosted on temporary WordPress platforms. This tactic suggests a shared infrastructure among various phishing messages.
The fake payment forms are sophisticated, recognizing card details as they are typed. Although similar setups have been seen in other phishing scams, Fortra did not link this specific operation to previous ones. After victims submit their information, the site sends the data to a server while displaying a perpetual loading animation.
Operational Insights and Security Measures
During the scam, the browser frequently communicates with an operator dashboard, allowing a human to direct the victim to an OTP capture page or terminate the session. In one test, this setup generated nearly a thousand requests in just over four minutes, primarily involving dashboard polling.
The phishing method’s infrastructure complicates tracking, as sites are frequently replaced and show generic errors to unexpected requests. Researchers emphasize the need for users to verify billing through direct account access and for organizations to investigate and report such fraudulent activities.
Indicators of compromise, such as specific hosts and IPs, have been identified. As phishing attacks grow in sophistication, prompt response and awareness become crucial in preventing fraud. Organizations are advised to block suspicious infrastructure while ensuring legitimate users are not affected. Vigilance and proactive measures are key to safeguarding sensitive information.
