# ChatGPT Plus Billing Phishing Kit Uses Rotating WordPress Sites to Steal Payment Details and OTPs

> A phishing campaign impersonates OpenAI with fake ChatGPT Plus payment-failed billing emails that lead victims to counterfeit checkout pages hosted on short-lived Nexcess nxcli.io WordPress sites. A live operator panel controls victim progression and escalates promising victims to an OTP capture step to defeat card-issuer authentication.

- **Published:** 2026-11-02T12:30:54Z
- **Last reviewed:** 2026-11-02T12:30:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5054
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5054.png
- **ID:** TL-2026-5054
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (1 shown free below)

## Description

Fortra research, relayed by GBHackers on 2026-11-02, describes a sustained phishing campaign impersonating OpenAI. Lure emails warn of a failed ChatGPT Plus subscription payment and ask the recipient to update billing details. According to Fortra, the emails are sent from randomized or algorithmically generated sender addresses.

The links lead to a cluster of short-lived, randomly named WordPress instances on Nexcess (Liquid Web) managed hosting under nxcli.io. Each instance follows the pattern https://<10-char-hex>.nxcli.io/wp-admin/<random>/<random>/app/key.php. Fortra reports that sampled instances serve byte-for-byte identical client-side payload code, share the same WordPress core and theme versions, and carry the same hardcoded operator-panel identifier. That is consistent with one template cloned repeatedly. Nexcess hosting is cheap (from about $7/month) and supports a variable number of independent sites, so rotating hosts costs little.

The counterfeit checkout page collects card number, expiry, CVC and cardholder name. JavaScript sends these to an action.php endpoint. The page does not complete payment or advance to another screen; it shows an indefinite loading animation. Meanwhile the browser polls ../panel/classes/processor.php roughly every 500 ms as a heartbeat and for operator instructions. A live operator can redirect the victim to an OTP/verification-code collection page, show an error, or end the interaction. A captured issuer verification code could help authorize fraudulent transactions, although success depends on the bank's authentication controls.

The kit uses light anti-analysis measures: obscured form field names, HTTP 400/403 responses to unexpected visits, and token-bearing URL segments with session-dependent polling. Traffic is protected by TLS in transit, but submitted card values are readable to the attacker after TLS termination. No CVE is involved and the sources name no threat actor. Fortra says the kit appears to be actively evolving. The GBHackers article also notes that Cofense has documented related credential phishing using nxcli.io and Google redirect wrappers; that Cofense report was not independently retrieved. Blanket blocking of nxcli.io may affect legitimate Nexcess customers.

## MITRE ATT&CK

- T1583.006 Web Services
- T1598.003 Spearphishing Link
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1111 Multi-Factor Authentication Interception
- T1056 Input Capture
- T1071.001 Web Protocols
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ChatGPT Plus Billing Phishing Kit Checkout Page on nxcli.io (key.php) — Exploitation** (`TL-2026-5054-SPL-001`)

Detects web-proxy requests to the counterfeit OpenAI/ChatGPT Plus checkout page of the Fortra-documented phishing kit: https://<10-hex>.nxcli.io/wp-admin/<random>/<random>/app/key.php on disposable Nexcess WordPress hosts. A hit means a user followed a billing-failure lure and reached the card-harvesting page (T1566.002 / T1204.001). Pattern-based, so it keeps working as hosts rotate.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.001, T1583.006
- **Data sources:** proxy, zscalernss-web
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="zscalernss-web" earliest=-24h url="*.nxcli.io/wp-admin/*"
| regex url="(?i)^https?://[0-9a-f]{10}\.nxcli\.io/wp-admin/[^/]+/[^/]+/app/key\.php"
| eval threat_id="TL-2026-5054", kit="ChatGPT Plus billing phishing kit key.php checkout"
| stats count min(_time) as first_seen max(_time) as last_seen values(http_method) as methods values(action) as proxy_action by threat_id kit src user url
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL matches regex @"(?i)^https?://[0-9a-f]{10}\.nxcli\.io/wp-admin/[^/]+/[^/]+/app/key\.php"
| project TimeGenerated, SourceIP, SourceUserName, DestinationHostName, RequestURL, RequestMethod, DeviceVendor, DeviceAction
```

### Sigma

```yaml
title: ChatGPT Plus Billing Phishing Kit Checkout Page on nxcli.io
id: 5b0f7a52-3c1e-4d7a-9a61-0e2f4c8d1a01
status: experimental
description: Detects proxy requests to the fake ChatGPT Plus checkout page key.php served from random 10-hex nxcli.io WordPress hosts under /wp-admin/.
references:
  - https://www.fortra.com/blog/anatomy-openai-phishing-kit-rotating-wordpress-hosts-live-operators-and-otp-theft
  - https://gbhackers.com/chatgpt-phishing-kit/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.resource_development
  - attack.t1583.006
logsource:
  category: proxy
detection:
  selection_host:
    cs-host|re: '^[0-9a-f]{10}\.nxcli\.io$'
  selection_path:
    c-uri|re: '/wp-admin/[^/]+/[^/]+/app/key\.php'
  condition: selection_host and selection_path
falsepositives:
  - Security researchers or URL-scanning sandboxes fetching the page
  - Phishing-awareness exercises that reuse this URL structure
level: high

```

**Known false positives:**

- Security analysts or sandboxes detonating the reported URL
- Authorized phishing simulations reusing the kit URL structure

**Tuning notes:** Map url/user/src to your proxy sourcetype (CIM Web data model works). Hosts are rotated so keep the regex, not literal hostnames. Allowlist sandbox egress IPs. Pair with email purge for the matching user. Avoid blanket nxcli.io blocking because legitimate Nexcess customers use it.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- OpenAI ChatGPT Plus Payment-Failed Lure Email from Non-OpenAI Sender — Exploitation (locked: unlock with TL Creds)
- Card Data Submission POST to [indicator] on [indicator] Phishing Host — Post-Exploitation (locked: unlock with TL Creds)
- User Click-Through to [indicator] Phishing Host, Including Google Redirect Wrapper — Exploitation (locked: unlock with TL Creds)
- Google Redirect Wrapper Pointing to [indicator] Phishing Host — Exploitation (locked: unlock with TL Creds)
- Phishing Kit Endpoint Activity on [indicator] ([indicator], [indicator], [indicator]) — Post-Exploitation (locked: unlock with TL Creds)
- ChatGPT Phishing Kit Path Structure on Non-[indicator] Hosts (Kit Migration Hunt) — C2/Infrastructure (locked: unlock with TL Creds)
- Phishing Kit Operator-Panel Heartbeat Polling of [indicator] (~500 ms) — OTP Capture Stage (locked: unlock with TL Creds)
- DNS Resolution of Random 10-Hex [indicator] Subdomains (Rotating Phishing Hosts) — Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 11)

Defanged, TLP:CLEAR.

- Domain: `nxcli[.]io`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [New ChatGPT Phishing Kit Uses Rotating WordPress Websites to Steal Payment Details and OTPs](https://gbhackers.com/chatgpt-phishing-kit/)
- [Fortra: Anatomy of an OpenAI Phishing Kit - Rotating WordPress Hosts, Live Operators and OTP Theft](https://www.fortra.com/blog/anatomy-openai-phishing-kit-rotating-wordpress-hosts-live-operators-and-otp-theft)
- [Fortra: ratpressto phishing kit (related Fortra research on WordPress-hosted kits; page not retrievable, content unverified)](https://www.fortra.com/blog/ratpressto-phishing-kit)
- [URLert: nxcli.io domain reputation](https://www.urlert.com/domains/nxcli.io)
- [MalwareTips URL scan: 4f70b74c7c.nxcli.io](https://tools.malwaretips.com/url-scan/4f70b74c7c.nxcli.io)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5054