# ChatGPT Plus Billing Phishing Campaign Spoofs Stripe Checkout to Harvest Payment Card Data

> A phishing campaign impersonates ChatGPT/OpenAI billing notifications, falsely claiming a subscription payment failure to drive victims to a fake Stripe-branded checkout page hosted on the free tier of AlwaysData cloud hosting. The page simulates a VISA verification pop-up and a fabricated transaction-timeout error to coax victims into repeatedly re-entering card details, harvesting email address, full card number, expiry date, CVC, cardholder name, and billing address.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1534
- **ID:** TL-2026-1534
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MailGuard intercepted a phishing campaign impersonating ChatGPT/OpenAI billing communications. The lure email, sent using the display name "Chat GPT" (a spacing/branding inconsistency versus OpenAI's actual "ChatGPT" branding) from the non-OpenAI sender domain imi2001.co.jp, informs the recipient that their most recent ChatGPT Plus subscription payment failed on a specified date and instructs them to check with their bank or card issuer before clicking through to resolve the issue. The message contains two links — an "Update your payment details here" call-to-action and a secondary "support article" link — both of which resolve to the same attacker-controlled destination rather than to distinct legitimate resources, a classic tell of a single-destination phishing lure dressed up with redundant pretexts.

Clicking either link delivers the victim to a spoofed Stripe checkout page that visually imitates OpenAI's real Stripe-hosted billing flow but is instead hosted on argentina.alwaysdata.net, a subdomain of the free tier of the French cloud host AlwaysData. AlwaysData's free plan only permits use of the provider's own *.alwaysdata.net subdomain (a paid plan is required to attach a custom domain), which is precisely why the attacker is operating from a *.alwaysdata.net address rather than a domain that could pass a superficial brand-name check — the giveaway is structural to the hosting tier, not incidental. AlwaysData's terms of service explicitly list phishing as prohibited/abuse-actionable content, and the provider maintains a public abuse-reporting channel (abuse@alwaysdata.com), consistent with this being an unauthorized abuse of a legitimate free-hosting service rather than attacker-owned infrastructure.

The fake checkout page requests the victim's email address, full primary account number (PAN), card expiry date, CVC, cardholder name, and billing address — the complete data set needed for card-not-present fraud. After submission, the page displays a VISA-branded modal with a loading/verification indicator to simulate a legitimate 3-D Secure-style authentication step, building victim confidence that the transaction is being processed normally. The modal is engineered to time out and return the victim to the payment form with a generic error, after which the page displays a message encouraging the victim to retry — a technique that both increases the odds of harvesting a second, potentially corrected/verified card number (catching typos or expired cards from the first submission) and desensitizes the victim to the abnormal flow. MailGuard also observed a page variant styled as a "PAYMENT ISSUE" screen with a red warning box, an urgency-escalation variant of the same kit deployed against the same lure.

This campaign fits a broader and recurring pattern of OpenAI/ChatGPT billing impersonation observed by multiple vendors through 2024-2026. Barracuda's October 2024 reporting documented a related large-scale "OpenAI Payments" billing-failure campaign sent to 1,000+ recipients from the unrelated sender domain mta.topmarinelogistics.com; that campaign's messages passed DKIM/SPF authentication because they were relayed through a legitimately-authorized (but abused/compromised) sending infrastructure, and used per-message variable/obfuscated hyperlinks — where the visible link text differed from the actual destination — to evade static email-security signatures. Separately, INKY documented a ChatGPT-impersonation credential-phishing kit that hosted its fake login page on IPFS decentralized storage (ipfs.dweb.link), used a URL-fragment parameter to dynamically personalize the phishing page per victim/target-company, and used JavaScript's window.location.replace() to redirect victims without leaving a browser-history entry, complicating post-incident triage. These related campaigns are NOT confirmed to share infrastructure or actor identity with the imi2001.co.jp / argentina.alwaysdata.net campaign documented here, but they establish that ChatGPT Plus's large, actively-billed subscriber base is a recognized high-yield target for payment-failure social engineering, and that the tooling/evasion techniques observed elsewhere in this campaign family (link obfuscation, decentralized/free-tier hosting abuse, anti-forensic JS redirects) are relevant defensive context for detection engineering. No CVE, malware family, or C2 beaconing infrastructure is associated with the specific imi2001.co.jp / argentina.alwaysdata.net campaign; it is a pure credential/payment-data harvesting phishing operation delivered via email and a static/JS-driven fake checkout kit, with no server-side C2 correlation found in BeaconBeagle for the observed hosting domain as of this writing.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1566 Phishing
- T1598 Phishing for Information
- T1684.001 Impersonation
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1111 Multi-Factor Authentication Interception
- T1056 Input Capture
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [ChatGPT 'Update Your Payment Details' Phishing Email Leads to Fake Stripe Payment Page](https://www.mailguard.com.au/blog/chatgpt-update-your-payment-details-phishing-email-leads-to-fake-stripe-payment-page)
- [Abuse notification | alwaysdata](https://www.alwaysdata.com/en/abuse/)
- [Public Cloud Restrictions :: alwaysdata Documentation](https://help.alwaysdata.com/en/accounts/public-cloud-restrictions/)
- [Report phishing to alwaysdata - phish.report](https://phish.report/contacts/alwaysdata)
- [Cybersecurity Firms Hit by Fraudulent OpenAI Phishing Campaign](https://www.safestate.com/post/cybersecurity-firms-hit-by-fraudulent-openai-phishing-campaign)
- [Fresh Phish: ChatGPT Impersonation Fuels a Clever Phishing Scam](https://www.inky.com/en/blog/fresh-phish-chatgpt-impersonation-fuels-a-clever-phishing-scam)
- [Cybercriminals impersonate OpenAI in large-scale phishing attack](https://blog.barracuda.com/2024/10/31/impersonate-openai-steal-data)
- [AI impersonation scam targets ChatGPT subscription users](https://securitybrief.com.au/story/ai-impersonation-scam-targets-chatgpt-subscription-users)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1534