# ChatGPT phishing scam targets subscription users Fake billing emails mimic OpenAI to steal login credentials - **Source:** [Technology News Articles on Fox News](https://www.foxnews.com/tech) - **Published:** 2026-09-27 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/9af7b2f6-945b-488d-8443-1e47614b23b3 ## Sophisticated phishing tactic Security researchers at Cofense identified a phishing campaign impersonating OpenAI's subscription notifications. The emails use authentic ChatGPT branding and create urgency with 48-hour action warnings. Attackers leverage polished design and psychological pressure to bypass user skepticism. The campaign specifically targets both personal and work accounts of paying ChatGPT users. ## Deceptive email elements The fraudulent emails display 'Subscription Payment Required' prominently and include an 'Update Payment Information' button. They appear to come from 'The OpenAI Team' but originate from suspicious domains like nxcli.io. Attackers combine familiar logos with time-sensitive language to prompt quick action. Unlike legitimate OpenAI communications, these emails use unofficial sender addresses. ## Multi-stage attack process Clicking the email button first redirects through Google API to appear legitimate, then forwards to attacker-controlled sites. The phishing pages perfectly replicate ChatGPT's login interface but host on unrelated domains. After credential capture, victims see error screens mimicking temporary login issues. This multi-layer deception makes the scam harder to detect during quick email checks. ## Credential harvesting mechanism The fake login pages capture both account credentials and payment information entered by victims. Attackers immediately receive stolen data while showing plausible error messages. Unlike typical phishing, this campaign specifically targets ChatGPT's paying user base. The use of intermediate Google redirects adds credibility to malicious links. ## Domain verification critical OpenAI uses specific domains like @openai.com and @mail.openai.com for official communications. The phishing emails come from completely unrelated domains that users can verify by expanding sender details. Legitimate ChatGPT login occurs only through chat.openai.com or official apps. Scammers cannot spoof these official domains in browser address bars. ## Immediate response steps Users who entered credentials should immediately change passwords and review active sessions in ChatGPT settings. Those who shared payment details must contact card issuers to prevent fraud. Work account users should notify IT teams for additional monitoring. OpenAI's 2FA provides extra protection but doesn't terminate existing sessions automatically. ## Preventive measures Always access services directly rather than through email links. Use unique passwords and password managers for each account. Enable 2FA via authenticator apps or passkeys for critical services. Maintain updated antivirus software to detect malicious links. Regularly check billing through official apps instead of email prompts. ## Broader security implications This attack demonstrates how cybercriminals exploit trusted brands and routine transactions. The combination of polished design, psychological urgency, and technical obfuscation makes these campaigns effective. As AI services grow, expect more targeted attacks against their user bases. Security awareness remains the first defense against evolving phishing tactics. ## Sources covering this story - https://www.foxnews.com/tech/fake-chatgpt-billing-emails-steal-login — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._