Fake ChatGPT Billing Email Phishing Campaign Abuses Google API Redirect to Steal OpenAI Credentials via nxcli.io
Fake ChatGPT Billing Email Phishing Campaign Abuses Google (TL-2026-2548) is a medium-severity phishing campaign, first published 2026-09-17. It has no confirmed attribution, affects OpenAI ChatGPT / OpenAI Platform account holders (individual and, maps to 11 MITRE ATT&CK techniques (T1036.005, T1111, T1204.001), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-2548
- Threat ID
- TL-2026-2548
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-09-17
- Last reviewed
- 2026-09-17
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cross-sector
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Cofense's Phishing Defense Center identified an active credential-phishing campaign impersonating OpenAI with a fake ChatGPT billing notice demanding payment of a fabricated $23.80 balance within 48 hours. The email's payment button routes victims through a legitimate Google API redirect (notifications.googleapis.com) to a counterfeit ChatGPT login page on an abused nxcli.io hosting subdomain that harvests OpenAI account credentials.
How Fake ChatGPT Billing Email Phishing Campaign Abuses Google works
On 2026-09-17, Cofense Phishing Defense Center analyst Josh Varden publicly documented a mass credential-phishing campaign impersonating OpenAI/ChatGPT billing communications. The lure email, sent from support@9527db6e1a.nxcli.io (a subdomain of the shared hosting domain nxcli.io, not an OpenAI-owned domain), carries the subject 'Urgent: Update Your Payment Method to Avoid Service Interruption,' the ChatGPT logo, and a fabricated outstanding balance of $23.80, with a 48-hour countdown to service suspension designed to pressure the recipient into immediate, unconsidered action.
The email's 'Update Payment Information' button does not link directly to the attacker's infrastructure. Instead, its URL begins at notifications.googleapis.com, a legitimate Google API domain, which redirects the browser onward to the actual phishing payload hosted on the nxcli.io subdomain. This is a defense-evasion pattern Cofense has separately documented as a broader 2024-2025 trend: threat actors chain phishing links through trusted first-party cloud domains (Google AMP, google.com/url, storage.googleapis.com, and now notifications.googleapis.com) specifically because secure email gateways (SEGs) and reputation-based URL filters extend implicit trust to Google-owned domains and often only inspect the first hop, not the final redirect destination.
The landing page clones the ChatGPT/OpenAI sign-in experience, displaying the ChatGPT logo and a 'Welcome back' greeting above username and password fields, visually approximating the legitimate auth.openai.com login page. Cofense identified two paths on the phishing host: login.php, which captures the submitted username and password, and key.php, a second path suggesting a follow-on data-capture or verification step after initial credential entry. After submission, victims are redirected to a generic error page rather than back to a real OpenAI property, a common technique to reduce victim suspicion and avoid immediately confirming the compromise.
This campaign is not an isolated event. Check Point's Q2 2026 Brand Phishing Report found that ChatGPT entered the top 10 most-impersonated brands in phishing attacks for the first time, following a fraudulent 'ChatGPT Plus payment failed' email Check Point observed in June 2026 using the same billing-failure social-engineering pattern. A separate, independently documented wave of the identical $23.80 billing lure (invoice reference INV-2026-08-10-001, dated 2026-08-10) was reported by MalwareTips on 2026-08-13, using a different sending domain (bellnet.ca — a legitimate Canadian ISP webmail domain, per a corroborating OpenAI community forum report, indicating a likely compromised consumer email account rather than attacker-registered infrastructure) but the same fabricated amount, urgency framing, and harvesting workflow — indicating the underlying phishing kit or lure template is being reused and redistributed across multiple sending infrastructures rather than being unique to the nxcli.io wave. MalwareTips documents this corroborating wave's data-collection form as a nine-step sequence: after the ChatGPT/email credentials (email + password) are captured, the same fake flow proceeds to request the full payment card number, expiration date, CVV security code, cardholder name, billing address, and phone number, and then prompts for a bank-issued one-time verification code (OTP) before landing on a reassuring confirmation page designed to delay victim suspicion and detection. No CVE or software vulnerability is implicated; this is a pure social-engineering and infrastructure-abuse campaign targeting OpenAI/ChatGPT account credentials, payment-card data, and bank OTP codes.
MITRE ATT&CK techniques used in TL-2026-2548
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation
Credential Access
T1111 Multi-Factor Authentication Interception
Execution
Initial Access
Resource Development
T1583.006 Web Services; T1585.002 Email Accounts; T1586.002 Email Accounts; T1608.005 Link Target
Reconnaissance
Impact
Affected products and versions in Fake ChatGPT Billing Email Phishing Campaign Abuses Google
- OpenAI — ChatGPT / OpenAI Platform account holders (individual and business billing contacts)
Vulnerable versions: N/A — social-engineering campaign, not a software vulnerability; targets any OpenAI/ChatGPT account holder who receives the lure email
Fixed in: N/A
Remediation for Fake ChatGPT Billing Email Phishing Campaign Abuses Google
Immediate actions
- Block or quarantine inbound mail referencing the nxcli.io sending/hosting infrastructure (support@9527db6e1a.nxcli.io) and mail chaining through notifications.googleapis.com toward non-Google destinations paired with ChatGPT/OpenAI billing lures
- Instruct users who clicked the link and entered credentials to immediately reset their OpenAI/ChatGPT password and any reused passwords on other services
- Review OpenAI/ChatGPT account login and billing activity for signs of unauthorized access or payment-method changes following a suspected click
- Report confirmed phishing samples to OpenAI (help.openai.com) and, for US users, ReportFraud.ftc.gov
Workarounds
- Always navigate directly to chatgpt.com or type auth.openai.com rather than clicking links in billing/payment emails to manage ChatGPT subscription or payment settings
- Verify the browser address bar reads auth.openai.com (not a lookalike or third-party hosting domain) before entering any OpenAI credentials
- Treat unsolicited 'account suspension in 48 hours' urgency framing in billing emails as a phishing indicator regardless of the amount claimed
Longer-term hardening
- Extend security-awareness training to cover AI-platform billing/subscription phishing specifically, given ChatGPT's first-time entry into Check Point's top-10 most-impersonated-brands ranking in Q2 2026
- Enable and enforce multi-factor authentication on OpenAI/ChatGPT accounts, prioritizing Team/Enterprise admin and billing-owner accounts
- Tune secure email gateways and URL-reputation tooling to follow and inspect final redirect destinations rather than granting implicit trust to first-hop Google API/AMP/Cloud Storage domains, per Cofense's documented Google-redirect-abuse trend
- Establish a recurring watch for newly registered or newly observed subdomains on shared/free hosting platforms (e.g., nxcli.io) impersonating the organization's SaaS vendors
Timeline of Fake ChatGPT Billing Email Phishing Campaign Abuses Google
- Cofense publishes broader research documenting threat actors chaining phishing links through legitimate Google-owned redirect endpoints (Google AMP, google.com/url, Google Translate, Google Maps, Google Storage) to bypass secure-email-gateway URL reputation checks — the same trusted-domain redirect-abuse technique later observed via notifications.googleapis.com in the nxcli.io ChatGPT billing campaign
- Cofense publishes data showing malicious email attacks accelerated to one every 19 seconds in 2025 (from one every 42 seconds in 2024), the detection-volume backdrop behind the Phishing Defense Center's continued identification of brand-impersonation campaigns such as this one
- Check Point's Q2 2026 Brand Phishing Report is reported showing ChatGPT entering the top 10 most-impersonated brands for the first time, citing an earlier fraudulent 'ChatGPT Plus payment failed' email observed in June 2026 using the same billing-failure lure pattern
- A parallel wave of the identical $23.80 fake ChatGPT/OpenAI billing lure (invoice reference INV-2026-08-10-001) circulates using a different sending domain (bellnet.ca), reusing the same urgency template and payment-harvesting workflow but distinct infrastructure from the nxcli.io wave
- MalwareTips publishes a technical writeup of the related $23.80 ChatGPT payment-update phishing wave (invoice INV-2026-08-10-001), documenting a nine-step workflow that harvests ChatGPT email/password credentials, then full payment card number, expiration, CVV, cardholder name, billing address, and phone number, then a bank-issued one-time verification code, before showing a reassuring confirmation page
- Help Net Security publishes coverage of the Cofense analysis, detailing the $23.80 fake balance, 48-hour suspension threat, the sender address support@9527db6e1a.nxcli.io, and the Google-redirect defense-evasion chain
- Cofense Phishing Defense Center analyst Josh Varden identifies and traces the campaign's 'Update Payment Information' button through a notifications.googleapis.com redirect to the nxcli.io credential-harvesting page (login.php, key.php)
Sources cited for Fake ChatGPT Billing Email Phishing Campaign Abuses Google
- A fake ChatGPT billing email is after your OpenAI password
- ChatGPT Among Top 10 Most Impersonated Brands in Phishing Attacks
- ChatGPT joins the most impersonated brands in phishing attacks
- Which Brands Are Impersonated Most? Inside the Q2 2026 Brand Phishing Report
- Google Redirect Abuse in 2024: Key Trends & Tactics
- Cofense Report Reveals AI-Powered Phishing Accelerated to One Attack Every 19 Seconds
- ChatGPT Payment Method Update Email Scam: Avoid This Fake Bill
- Scam Alert: Fake OpenAI Subscription Email Requesting Payment Details
More in phishing
- Large-Scale Azure-Hosted Tech Support Scam Campaign Targets Japan (13.38M Emails, 240K+ Relay IPs, 33K+ Disposable Azure Blob Storage Sites)
- Phishing Campaign Impersonates ChatGPT Subscription Billing Alerts to Steal OpenAI Credentials via Google API Open-Redirect and nxcli.io Infrastructure
- Global Fake Parcel Delivery Phishing/Smishing Campaign Steals Card and Bank Details
- Fake myGov 'Secure Message' Phishing Scam Targets Australians with Multi-Step Identity Harvesting Flow
- Revolut Phishing SMS Campaign Follows Social-Engineering Data Breach Exposing 680 Customers' KYC Data
Detection coverage for TL-2026-2548
As of 2026-09-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2548 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.