Scammers have launched a credential-harvesting campaign aimed directly at ChatGPT subscribers, using fake OpenAI billing notices to steal login credentials and payment information.

How the Scam Works:

• The Bait: You receive an urgent email titled “Subscription Payment Required,” claiming a $23.80 charge failed and giving you 48 hours to update your billing info.
• The Deception: The email features official ChatGPT logos and routes the “Update Payment Information” button through a Google API redirect link (notifications.googleapis.com) to bypass spam filters.
• The Trap: Clicking the link sends you to a fake login portal (nxcli.io) designed to look identical to OpenAI’s official sign-in page. Any credentials or payment card details entered are immediately captured by attackers.

Red Flags to Watch For:

• Sender email addresses coming from unofficial domains (e.g., support@...nxcli.io instead of openai.com).
• Urgency tactics giving short deadlines (e.g., “48 hours”) to fix account issues.
• Login URLs in your browser bar that do not end in .openai.com.

Data Defense Steps:

• Do not click embedded links: If you receive a payment alert, navigate directly to chatgpt.com or openai.com in a new browser tab to check your billing status.
• Verify the sender domain: Always inspect the full email address of any billing-related notification.
• Enable Multi-Factor Authentication (MFA): Secure your primary email and AI accounts with MFA to prevent unauthorized access even if credentials are compromised.

(Shoutout to Josh Varden of the Cofense Phishing Defense Center)