Phishing · 1 source · latest 15h

Fake ChatGPT Plus billing emails steal card details and one-time passwords

PHISHINGOpenAIredteam/daily · 1 source

Severity: High
Sources: 1

What happened

Fortra reports a phishing kit impersonating OpenAI ChatGPT Plus billing, hosted on short-lived WordPress instances and redirect wrappers. Card data, expiry, CVV and cardholder name are posted to action.php, then the browser polls a dashboard (processor.php using keepAlive and redirectionListener) while an operator routes victims to OTP capture pages (token.php, code.php). Identical client code and an application identifier were seen across sites about a week apart, and the published IoCs include host, IP, redirect domain and URL pattern indicators. Defenders should hunt for the recurring page structure and dashboard polling traffic, and should block only where collateral impact on shared hosting is acceptable. No CVEs are cited.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Verify any billing notice through your account directly rather than through an email link.
Investigate whether your organisation has received matching OpenAI-themed billing emails.
Hunt for the published indicators of compromise, including the recurring landing page structure and dashboard polling traffic, within your SIEM.
Report fraudulent hosting to the relevant provider, taking care with broad blocks because legitimate customers share the platform.

Written by AI from the sources, checked against them

Read the full story at the source