# Fake ChatGPT Billing Email Phishing Campaign Abuses Google API Redirect to Steal OpenAI Credentials via nxcli.io

> Cofense's Phishing Defense Center identified an active credential-phishing campaign impersonating OpenAI with a fake ChatGPT billing notice demanding payment of a fabricated $23.80 balance within 48 hours. The email's payment button routes victims through a legitimate Google API redirect (notifications.googleapis.com) to a counterfeit ChatGPT login page on an abused nxcli.io hosting subdomain that harvests OpenAI account credentials.

- **Published:** 2026-09-17T00:00:00Z
- **Last reviewed:** 2026-09-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2548
- **ID:** TL-2026-2548
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-09-17, Cofense Phishing Defense Center analyst Josh Varden publicly documented a mass credential-phishing campaign impersonating OpenAI/ChatGPT billing communications. The lure email, sent from support@9527db6e1a.nxcli.io (a subdomain of the shared hosting domain nxcli.io, not an OpenAI-owned domain), carries the subject 'Urgent: Update Your Payment Method to Avoid Service Interruption,' the ChatGPT logo, and a fabricated outstanding balance of $23.80, with a 48-hour countdown to service suspension designed to pressure the recipient into immediate, unconsidered action.

The email's 'Update Payment Information' button does not link directly to the attacker's infrastructure. Instead, its URL begins at notifications.googleapis.com, a legitimate Google API domain, which redirects the browser onward to the actual phishing payload hosted on the nxcli.io subdomain. This is a defense-evasion pattern Cofense has separately documented as a broader 2024-2025 trend: threat actors chain phishing links through trusted first-party cloud domains (Google AMP, google.com/url, storage.googleapis.com, and now notifications.googleapis.com) specifically because secure email gateways (SEGs) and reputation-based URL filters extend implicit trust to Google-owned domains and often only inspect the first hop, not the final redirect destination.

The landing page clones the ChatGPT/OpenAI sign-in experience, displaying the ChatGPT logo and a 'Welcome back' greeting above username and password fields, visually approximating the legitimate auth.openai.com login page. Cofense identified two paths on the phishing host: login.php, which captures the submitted username and password, and key.php, a second path suggesting a follow-on data-capture or verification step after initial credential entry. After submission, victims are redirected to a generic error page rather than back to a real OpenAI property, a common technique to reduce victim suspicion and avoid immediately confirming the compromise.

This campaign is not an isolated event. Check Point's Q2 2026 Brand Phishing Report found that ChatGPT entered the top 10 most-impersonated brands in phishing attacks for the first time, following a fraudulent 'ChatGPT Plus payment failed' email Check Point observed in June 2026 using the same billing-failure social-engineering pattern. A separate, independently documented wave of the identical $23.80 billing lure (invoice reference INV-2026-08-10-001, dated 2026-08-10) was reported by MalwareTips on 2026-08-13, using a different sending domain (bellnet.ca — a legitimate Canadian ISP webmail domain, per a corroborating OpenAI community forum report, indicating a likely compromised consumer email account rather than attacker-registered infrastructure) but the same fabricated amount, urgency framing, and harvesting workflow — indicating the underlying phishing kit or lure template is being reused and redistributed across multiple sending infrastructures rather than being unique to the nxcli.io wave. MalwareTips documents this corroborating wave's data-collection form as a nine-step sequence: after the ChatGPT/email credentials (email + password) are captured, the same fake flow proceeds to request the full payment card number, expiration date, CVV security code, cardholder name, billing address, and phone number, and then prompts for a bank-issued one-time verification code (OTP) before landing on a reassuring confirmation page designed to delay victim suspicion and detection. No CVE or software vulnerability is implicated; this is a pure social-engineering and infrastructure-abuse campaign targeting OpenAI/ChatGPT account credentials, payment-card data, and bank OTP codes.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1036.005 Match Legitimate Resource Name or Location
- T1583.006 Web Services
- T1608.005 Link Target
- T1585.002 Email Accounts
- T1586.002 Email Accounts
- T1598.003 Spearphishing Link
- T1111 Multi-Factor Authentication Interception
- T1657 Financial Theft

## Sources

- [A fake ChatGPT billing email is after your OpenAI password](https://www.helpnetsecurity.com/2026/09/17/chatgpt-phishing-email-openai-password/)
- [ChatGPT Among Top 10 Most Impersonated Brands in Phishing Attacks](https://www.infosecurity-magazine.com/news/chatgpt-most-impersonated-brands/)
- [ChatGPT joins the most impersonated brands in phishing attacks](https://www.helpnetsecurity.com/2026/07/27/check-point-brand-phishing-trends-report/)
- [Which Brands Are Impersonated Most? Inside the Q2 2026 Brand Phishing Report](https://blog.checkpoint.com/research/which-brands-are-impersonated-most-inside-the-q2-2026-brand-phishing-report/)
- [Google Redirect Abuse in 2024: Key Trends & Tactics](https://cofense.com/blog/google-redirect-abuse-in-2024-key-trends-tactics)
- [Cofense Report Reveals AI-Powered Phishing Accelerated to One Attack Every 19 Seconds](https://www.businesswire.com/news/home/20260204840917/en/Cofense-Report-Reveals-AI-Powered-Phishing-Accelerated-to-One-Attack-Every-19-Seconds)
- [ChatGPT Payment Method Update Email Scam: Avoid This Fake Bill](https://malwaretips.com/blogs/chatgpt-payment-method-update-email-scam/)
- [Scam Alert: Fake OpenAI Subscription Email Requesting Payment Details](https://community.openai.com/t/scam-alert-fake-openai-subscription-email-requesting-payment-details/1266793)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2548