Threat reportPhishingTL-2026-5054
ChatGPT Plus Billing Phishing Kit Uses Rotating WordPress Sites to Steal Payment Details and OTPs
A phishing campaign impersonates OpenAI with fake ChatGPT Plus payment-failed billing emails that lead victims to counterfeit checkout pages hosted on short-lived Nexcess nxcli.io WordPress sites. A live operator panel controls victim progression and escalates promising victims to an OTP capture step to defeat card-issuer authentication.
Key facts for ChatGPT Plus billing phishing
| Identifiers | TL-2026-5054 |
|---|---|
| Severity | MEDIUM |
| Exploitation status | Exploited in the wild |
| Affected products | OpenAI ChatGPT Plus (brand impersonated; the service itself is not vulnerable) |
| Tools | Fortra |
| MITRE ATT&CK techniques | T1056 Input Capture, T1071.001 Web Protocols, T1111 Multi-Factor Authentication Interception, T1204.001 Malicious Link, T1566.002 Spearphishing Link, T1583.006 Web Services, T1598.003 Spearphishing Link, T1657 Financial Theft, T1684.001 Impersonation |
| Motivation | FINANCIAL |
| Target sectors | consumer, technology |
| Target regions | Global |
| Detection rules | 9 (1 shown free) |
| Sources | 5 cited sources |
Detection coverage for ChatGPT Plus billing phishing
As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5054 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: ChatGPT Plus Billing Phishing Kit Checkout Page on nxcli.io (key.php) — Exploitation
Detects web-proxy requests to the counterfeit OpenAI/ChatGPT Plus checkout page of the Fortra-documented phishing kit: https://<10-hex>.nxcli.io/wp-admin/<random>/<random>/app/key.php on disposable Nexcess WordPress hosts. A hit means a user followed a billing-failure lure and reached the card-harvesting page (T1566.002 / T1204.001). Pattern-based, so it keeps working as hosts rotate.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1566.002, T1204.001, T1583.006
- Data sources: proxy, zscalernss-web
- Severity: high
- Confidence: high
Splunk SPL
index=proxy sourcetype="zscalernss-web" earliest=-24h url="*.nxcli.io/wp-admin/*"
| regex url="(?i)^https?://[0-9a-f]{10}\.nxcli\.io/wp-admin/[^/]+/[^/]+/app/key\.php"
| eval threat_id="TL-2026-5054", kit="ChatGPT Plus billing phishing kit key.php checkout"
| stats count min(_time) as first_seen max(_time) as last_seen values(http_method) as methods values(action) as proxy_action by threat_id kit src user url
| convert ctime(first_seen) ctime(last_seen)Microsoft KQL
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL matches regex @"(?i)^https?://[0-9a-f]{10}\.nxcli\.io/wp-admin/[^/]+/[^/]+/app/key\.php"
| project TimeGenerated, SourceIP, SourceUserName, DestinationHostName, RequestURL, RequestMethod, DeviceVendor, DeviceActionSigma
title: ChatGPT Plus Billing Phishing Kit Checkout Page on nxcli.io
id: 5b0f7a52-3c1e-4d7a-9a61-0e2f4c8d1a01
status: experimental
description: Detects proxy requests to the fake ChatGPT Plus checkout page key.php served from random 10-hex nxcli.io WordPress hosts under /wp-admin/.
references:
- https://www.fortra.com/blog/anatomy-openai-phishing-kit-rotating-wordpress-hosts-live-operators-and-otp-theft
- https://gbhackers.com/chatgpt-phishing-kit/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
- attack.initial_access
- attack.t1566.002
- attack.execution
- attack.t1204.001
- attack.resource_development
- attack.t1583.006
logsource:
category: proxy
detection:
selection_host:
cs-host|re: '^[0-9a-f]{10}\.nxcli\.io$'
selection_path:
c-uri|re: '/wp-admin/[^/]+/[^/]+/app/key\.php'
condition: selection_host and selection_path
falsepositives:
- Security researchers or URL-scanning sandboxes fetching the page
- Phishing-awareness exercises that reuse this URL structure
level: high
Known false positives:
- Security analysts or sandboxes detonating the reported URL
- Authorized phishing simulations reusing the kit URL structure
Tuning notes: Map url/user/src to your proxy sourcetype (CIM Web data model works). Hosts are rotated so keep the regex, not literal hostnames. Allowlist sandbox egress IPs. Pair with email purge for the matching user. Avoid blanket nxcli.io blocking because legitimate Nexcess customers use it.
- OpenAI ChatGPT Plus Payment-Failed Lure Email from Non-OpenAI Sender — Exploitation · unlock with TL Creds
- Card Data Submission POST to [indicator] on [indicator] Phishing Host — Post-Exploitation · unlock with TL Creds
- User Click-Through to [indicator] Phishing Host, Including Google Redirect Wrapper — Exploitation · unlock with TL Creds
- Google Redirect Wrapper Pointing to [indicator] Phishing Host — Exploitation · unlock with TL Creds
- Phishing Kit Endpoint Activity on [indicator] ([indicator], [indicator], [indicator]) — Post-Exploitation · unlock with TL Creds
- ChatGPT Phishing Kit Path Structure on Non-[indicator] Hosts (Kit Migration Hunt) — C2/Infrastructure · unlock with TL Creds
- Phishing Kit Operator-Panel Heartbeat Polling of [indicator] (~500 ms) — OTP Capture Stage · unlock with TL Creds
- DNS Resolution of Random 10-Hex [indicator] Subdomains (Rotating Phishing Hosts) — Infrastructure · unlock with TL Creds
Indicators of compromise for ChatGPT Plus billing phishing
As of 2026-11-02, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5054.
Sample indicators (1 of 11)
- Domain:
nxcli[.]io
Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.
How ChatGPT Plus billing phishing works
Fortra research, relayed by GBHackers on 2026-11-02, describes a sustained phishing campaign impersonating OpenAI. Lure emails warn of a failed ChatGPT Plus subscription payment and ask the recipient to update billing details. According to Fortra, the emails are sent from randomized or algorithmically generated sender addresses.
The links lead to a cluster of short-lived, randomly named WordPress instances on Nexcess (Liquid Web) managed hosting under nxcli.io. Each instance follows the pattern https://<10-char-hex>.nxcli.io/wp-admin/<random>/<random>/app/key.php. Fortra reports that sampled instances serve byte-for-byte identical client-side payload code, share the same WordPress core and theme versions, and carry the same hardcoded operator-panel identifier. That is consistent with one template cloned repeatedly. Nexcess hosting is cheap (from about $7/month) and supports a variable number of independent sites, so rotating hosts costs little.
The counterfeit checkout page collects card number, expiry, CVC and cardholder name. JavaScript sends these to an action.php endpoint. The page does not complete payment or advance to another screen; it shows an indefinite loading animation. Meanwhile the browser polls ../panel/classes/processor.php roughly every 500 ms as a heartbeat and for operator instructions. A live operator can redirect the victim to an OTP/verification-code collection page, show an error, or end the interaction. A captured issuer verification code could help authorize fraudulent transactions, although success depends on the bank's authentication controls.
The kit uses light anti-analysis measures: obscured form field names, HTTP 400/403 responses to unexpected visits, and token-bearing URL segments with session-dependent polling. Traffic is protected by TLS in transit, but submitted card values are readable to the attacker after TLS termination. No CVE is involved and the sources name no threat actor. Fortra says the kit appears to be actively evolving. The GBHackers article also notes that Cofense has documented related credential phishing using nxcli.io and Google redirect wrappers; that Cofense report was not independently retrieved. Blanket blocking of nxcli.io may affect legitimate Nexcess customers.
MITRE ATT&CK techniques by tactic:
Collection
Command and Control
Credential Access
T1111 Multi-Factor Authentication Interception
Execution
Initial Access
Resource Development
Reconnaissance
Impact
Defense Evasion
Remediation for ChatGPT Plus billing phishing
Immediate actions
- Block observed phishing URLs matching https://<10-char-hex>.nxcli.io/wp-admin/*/*/app/key.php at web proxy and email gateway
- Hunt mail logs for OpenAI/ChatGPT Plus billing-failure lures from non-OpenAI senders and purge matching messages
- Tell users to verify billing only by signing in to ChatGPT directly, never through email links
- Report unauthorized card charges to the card issuer immediately
Workarounds
- Blanket-blocking nxcli.io can affect legitimate Nexcess customers, so prefer pattern-based URL blocking or a monitor-and-alert policy
Longer-term hardening
- Add proxy and DNS detections for nxcli.io subdomains with wp-admin paths ending in app/key.php
- Prefer app-based or number-matching issuer authentication over SMS OTP where available
- Run user awareness training on billing-failure lures
Affected and fixed versions
- OpenAI — ChatGPT Plus (brand impersonated; the service itself is not vulnerable)
Timeline of ChatGPT Plus billing phishing
- GBHackers notes Cofense documented related credential phishing using locked-ioc-9 and Google redirect wrappers; the Cofense report date is not stated in the sources reviewed
- Browser polling of locked-ioc-3 about every 500 ms is documented, letting operators redirect victims to OTP collection, show an error, or end the session
- Phishing pages identified on rotating Nexcess (Liquid Web) locked-ioc-9 WordPress instances using the pattern locked-ioc-1
- Fortra analysis finds identical client-side payload code, WordPress core and theme versions, and the same hardcoded operator-panel identifier across sampled locked-ioc-9 sites
- At the time of reporting the campaign is described as sustained and active, with lure emails impersonating locked-ioc-11 ChatGPT Plus payment-failed billing notices
- GBHackers publishes an article on the ChatGPT Plus phishing kit, crediting Fortra's findings
Sources cited for ChatGPT Plus billing phishing
- Fortra: Anatomy of an OpenAI Phishing Kit - Rotating WordPress Hosts, Live Operators and OTP Theft fortra.com · Research
- Fortra: ratpressto phishing kit (related Fortra research on WordPress-hosted kits; page not retrievable, content unverified) fortra.com · Research
- URLert: nxcli.io domain reputation urlert.com · Blog
- MalwareTips URL scan: 4f70b74c7c.nxcli.io tools.malwaretips.com · Blog
- New ChatGPT Phishing Kit Uses Rotating WordPress Websites to Steal Payment Details and OTPs gbhackers.com · News · 2026-11-02
Drafted by the Threadlinqs research pipeline from 5 sources; published ; last updated —.
