If you pay for ChatGPT, an email saying there is a problem with your subscription could easily get your attention.
uncertain
email → pay → attention
Maybe your card expired.
asserted
card → expire → ?
Maybe the payment failed.
asserted
payment → fail → ?
Either way, you probably want to fix it before anything happens to your account.
asserted
anything → want → account
Cybercriminals are counting on that reaction.
asserted
Cybercriminals → count → reaction
Security researchers at Cofense uncovered a phishing campaign that impersonates OpenAI and ChatGPT.
asserted
that → uncover → OpenAI
The fake email looks like a routine subscription notice.
asserted
email → look → notice
However, the button inside can lead to a convincing copy of the ChatGPT login page.
asserted
button → lead → page
Cofense says the campaign targets account credentials and payment information.
asserted
campaign → say → credentials
Our free CyberGuy LIVE class, Get Better Healthcare With AI , has ended, but you can still watch the full replay.
asserted
you → get → replay
Kurt "CyberGuy" Knutsson walks you through five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor.
asserted
you → walk → doctor
No technical experience is needed.
asserted
experience → need → ?
Watch the free replay now at CyberGuyLive.com
How the fake ChatGPT billing email works
The scam starts with an email that looks polished enough to make you pause.
asserted
you → watch → email
According to the Cofense Phishing Defense Center, it uses the real ChatGPT logo and claims your subscription payment needs attention.
uncertain
payment → accord → attention
Then comes the pressure.
asserted
pressure → come → ?
The message prominently displays "Subscription Payment Required."
asserted
message → display → Payment
It also warns that you have 48 hours to act.
asserted
you → warn → hours
A large "Update Payment Information" button gives you an obvious way to supposedly fix the problem.
asserted
button → update → problem
Finally, the message signs off as "The OpenAI Team."
asserted
message → sign → Team
If you are checking email between meetings or quickly scrolling on your phone, all of that can feel believable.
asserted
all → check → that
Cofense says the attackers combine familiar images, bold wording and urgency to push people into acting quickly.
asserted
attackers → say → people
One email address exposes the ChatGPT scam
The sender's email address is one of the biggest red flags.
asserted
address → expose → flags
Cofense found that the phishing message came from support@9527db6e1a[.]nxcli[.]io.
asserted
message → find → support@9527db6e1a[.]nxcli[.]io
That domain has nothing to do with OpenAI.
asserted
domain → have → OpenAI
OpenAI currently lists several domains that it uses for legitimate customer emails.
asserted
it → list → emails
They include @openai.com, @mail.openai.com and @email.openai.com, along with other official OpenAI domains used for specific communications.
asserted
They → include → communications
That makes the full sender address worth checking.
asserted
address → make → ?
Do not rely on the name that appears in your inbox.
asserted
that → rely → inbox
A scammer can make the display name look reassuring while using a completely unrelated address behind it.
asserted
name → make → it
The fake payment button adds another trick
asserted
button → add → trick
The button inside this phishing email adds another layer of deception.
asserted
button → add → deception
Cofense found that clicking "Update Payment Information" first sent users through a Google API redirect.
asserted
Cofense → find → redirect
The link then forwarded them to the attacker's malicious site.
asserted
link → forward → site
That can make a suspicious link look more convincing at first glance because Google appears along the way.
asserted
Google → make → way
We have seen criminals abuse trusted services in similar attacks before.
asserted
criminals → see → attacks
CyberGuy previously covered how hackers used legitimate Google Cloud tools to send phishing messages that looked like authentic Google notifications.
asserted
that → cover → notifications
So, seeing Google somewhere in a link does not tell you where you will eventually land.
asserted
you → see → you
On a computer, hovering over a button can sometimes reveal the destination before you click.
asserted
you → hover → destination
Still, redirects can make that check less useful.
asserted
check → make → ?
The safer option is to skip the email link entirely.
asserted
option → skip → link
…and 52 more, not listed.
The Aporia
