<\/p>\n
If you pay for ChatGPT, an email saying there is a problem with your subscription could easily get your attention. Maybe your card expired. Maybe the payment failed. Either way, you probably want to fix it before anything happens to your account. Cybercriminals are counting on that reaction.<\/p>\n
Security researchers at Cofense uncovered a phishing campaign<\/a> that impersonates OpenAI and ChatGPT. The fake email looks like a routine subscription notice. However, the button inside can lead to a convincing copy of the ChatGPT login page. Cofense says the campaign targets account credentials and payment information.<\/p>\n Missed CyberGuy LIVE? Watch the Get Better Healthcare With AI replay<\/p>\n Our free CyberGuy LIVE class, Get Better Healthcare With AI , has ended, but you can still watch the full replay. Kurt “CyberGuy” Knutsson walks you through five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor. No technical experience is needed.<\/p>\n Watch the free replay now at CyberGuyLive.com<\/p>\n SCAMMERS KNOW THE BEST TIME TO TEXT YOU<\/strong><\/a><\/p>\n The scam starts with an email that looks polished enough to make you pause. According to the Cofense Phishing Defense Center, it uses the real ChatGPT logo and claims your subscription payment needs attention. Then comes the pressure. The message prominently displays “Subscription Payment Required.” It also warns that you have 48 hours to act. A large “Update Payment Information” button gives you an obvious way to supposedly fix the problem. Finally, the message signs off as “The OpenAI Team.” If you are checking email between meetings or quickly scrolling on your phone, all of that can feel believable. Cofense says the attackers combine familiar images, bold wording and urgency to push people into acting quickly.<\/p>\n The sender’s email address is one of the biggest red flags. Cofense found that the phishing message came from support@9527db6e1a[.]nxcli[.]io. That domain has nothing to do with OpenAI. OpenAI currently lists several domains that it uses for legitimate customer emails. They include @openai.com, @mail.openai.com and @email.openai.com, along with other official OpenAI domains used for specific communications. That makes the full sender address worth checking. Do not rely on the name that appears in your inbox. A scammer can make the display name look reassuring while using a completely unrelated address behind it.<\/p>\n FAKE CHROME UPDATE SCAM COULD INFECT YOUR COMPUTER<\/strong><\/a><\/p>\n The button inside this phishing email adds another layer of deception. Cofense found that clicking “Update Payment Information” first sent users through a Google API redirect. The link then forwarded them to the attacker’s malicious site. That can make a suspicious link look more convincing at first glance because Google appears along the way. We have seen criminals abuse trusted services in similar attacks before. CyberGuy previously covered how hackers used legitimate Google Cloud tools to send phishing messages that looked like authentic Google notifications. So, seeing Google somewhere in a link does not tell you where you will eventually land. On a computer, hovering over a button can sometimes reveal the destination before you click. Still, redirects can make that check less useful. The safer option is to skip the email link entirely.<\/p>\n Once someone clicks through, the scam gets harder to spot. Cofense says the phishing page<\/a> closely copies the ChatGPT login experience, complete with familiar logos, text and icons. However, the domain in the browser does not match the legitimate ChatGPT login domain identified by Cofense. If a victim enters login information, the fake site captures it and sends it to the attacker. The page then sends the victim to an error screen, which could easily look like a temporary login problem. By then, the attacker may already have the credentials. That is why it is worth checking the address bar before you enter a password. Scammers can copy the look of a login page. They cannot make an unrelated domain belong to OpenAI.<\/p>\n We reached out to OpenAI for comment but did not hear back before our deadline.<\/p>\n If an email says there is a payment problem, skip the button. Go directly to ChatGPT.com or open the official app and sign in yourself. For web subscriptions, OpenAI says to check Settings \u2192 Billing . Some accounts may show Settings \u2192 Account \u2192 Payment \u2192 Manage instead. If you subscribed through Apple or Google Play, manage your subscription through that store.<\/p>\n Expand the sender information and look at the actual email address. In this campaign, the sender used an nxcli.io domain. OpenAI publishes the domains it uses for legitimate communications, which gives you something concrete to compare against.<\/p>\n Check the browser address bar before entering a password or payment information. If the domain looks unfamiliar, close the page. Then open the service yourself through its official app or website. This same habit can protect you from fake banking sites. We recently covered criminals who bought sponsored search ads that sent victims to lookalike bank login pages.<\/p>\n Never reuse your ChatGPT password on other accounts. We recommend using a unique password and suggest a password manager <\/a>to generate and store it. That way, one stolen password cannot easily unlock several of your accounts.<\/p>\n