Phishing Campaign Exploiting ChatGPT Billing Notifications Targets Global Users

This campaign highlights the vulnerabilities in digital communication as AI adoption accelerates, affecting both personal and professional user security.

• Phishing emails impersonating ChatGPT billing notifications were identified in mid-September 2026.
• Users received alerts about a $23.80 payment failure, urging immediate action within 48 hours.
• Cofense researchers traced the emails to a counterfeit login page designed to harvest user credentials.

• Increased AI adoption has led to a surge in phishing attempts targeting popular services like ChatGPT, as users are accustomed to receiving billing notifications.
• Threat actors are leveraging brand impersonation tactics, making it easier to deceive users into providing sensitive information.
• Security measures are often inadequate, with many users unaware of how to verify the authenticity of such communications.

In mid-September 2026, a sophisticated phishing campaign emerged, targeting users of OpenAI's ChatGPT. Security researchers at Cofense uncovered emails sent from a suspicious domain, nxcli.io, which masqueraded as official billing notifications from ChatGPT. The emails claimed that a subscription payment of $23.80 had failed and demanded immediate action within 48 hours to avoid service disruption. This urgency is a common tactic in phishing schemes, designed to provoke hasty decisions from recipients.

The embedded links in these emails redirected users through a Google API, leading them to a counterfeit login page that closely resembled the legitimate ChatGPT interface. Once users entered their credentials, the attackers captured this sensitive information before redirecting them to an error page, further obscuring the scam. This method not only harvested login details but also posed a risk to payment information, making it a dual threat to users' financial and personal security.

The campaign's global reach is significant, affecting both personal and enterprise accounts. With the maximum number of emails delivered in a single day reaching 100,000 during a related broader campaign, the scale of this threat is alarming. The impersonation of a trusted brand like ChatGPT, which has become a staple in many users' digital lives, underscores the evolving tactics of cybercriminals. As AI services grow in popularity, they become prime targets for phishing attacks, exploiting users' familiarity with routine billing communications.

Despite the widespread nature of this campaign, no specific geographic origin or single perpetrator has been identified, indicating a potentially decentralized network of threat actors. The lack of a public statement from OpenAI further complicates the response landscape, leaving users to navigate these threats largely on their own. Security experts emphasize the importance of direct account verification through official channels and the implementation of multi-factor authentication to mitigate risks.

• Individual users: Personal ChatGPT accounts are at risk of credential theft and financial fraud.
• Businesses: Enterprise accounts may face data breaches, leading to compromised client information and financial losses.
• Security professionals: Increased workload as they respond to phishing incidents and educate users on prevention.
• AI service providers: Companies like OpenAI may experience reputational damage and increased scrutiny over user security.

• Emerging phishing tactics: Monitor for new methods that exploit other popular AI services as they gain traction.
• User education initiatives: Look for increased efforts from companies to educate users on identifying phishing attempts.
• Regulatory responses: Watch for potential regulations aimed at enhancing cybersecurity measures for digital services.