Scammers have launched a sophisticated phishing campaign impersonating OpenAI by sending bogus ChatGPT Plus billing emails. These emails tell recipients their subscription payment failed and encourage them to update payment info—trapping victims into fake checkout pages designed to steal credit card details and one-time passwords (OTPs). Researchers uncovered this scheme and detailed how it works on October 26, 2026.
How the Scam Operates
The phishing emails arrive looking like authentic OpenAI notices, complete with subscription failure warnings and urgent calls to update billing information. The embedded links lead through various redirects to fake checkout pages hosted on short-lived WordPress sites. These checkout pages mimic real payment forms—auto-formatting card numbers, expiration dates, CVV codes— and collect cardholder data as users type.
But the pages go further: after submitting payment info, users aren’t actually moved forward. Instead, a loading spinner appears indefinitely. Behind the scenes, victims’ browsers constantly contact an operator-controlled dashboard, waiting for human instructions. During these sessions, attackers may prompt for the OTP, display errors, or end the session—all depending on what they decide in real time. One such test lasted over four minutes and involved nearly a thousand server requests. The scam doesn’t guarantee fraud succeeds, but it creates the conditions for OTP interception and unauthorized payments.
Infrastructure & Detection Signs
Researchers found that multiple phishing emails shared the same landing page design during a wave of attacks, suggesting a shared backend infrastructure. These WordPress instances appeared, then disappeared, and were replaced by others over time. Whether attackers hijacked existing sites or spun up their own hosting accounts hasn’t been fully determined.
Investigators also documented specific indicators of compromise (IoCs): confirmed hostnames and IPs, landing page URL patterns (including 10-character hexadecimal subdomains under “nxcli.io”), submission and dashboard endpoints, redirect domains like “authgpt.info,” “ai-billing.info,” and paths linked to OTP capture (e.g. “token.php,” “code.php”). These traffic patterns—especially repeated polling to an operator dashboard—along with shared client-side application identifiers offer clues defenders can use to spot attacks.
Defense Measures & Recommendations
Users are advised to never click billing update links from unsolicited emails. Instead, they should verify payment status by logging directly into OpenAI accounting pages. Any suspicious messages should be reported. For companies and incident response teams, watching for recurring infrastructure patterns and IP/domain overlaps across campaigns can help detect ongoing threats. Blocking fraudulent hosting may offer some protection—but caution is required since platforms are often shared between malicious and benign sites.
What makes this phishing campaign especially dangerous is its dynamic operator involvement. The attackers don’t just set and forget—live operator dashboards allow them to steer each session, choose when to ask for OTPs, or pretend there’s a processing error, maintaining the illusion of legitimacy. Because this scheme hinges on timing and interaction, it highlights how fraud is becoming increasingly tailored, going beyond static fishhooks toward live, responsive attacks. One sign to watch: if a payment page doesn’t process your card immediately and instead shows a never-ending spinner, that may mean you’ve been trapped in one of these phishing operations. Keep your vetting tight and your instincts sharper.
