Threat video1:00
ChatGPT Plus Billing Phishing Kit: Detection & IOCs
Fake ChatGPT Plus payment-failed emails lead to rotating WordPress checkouts that capture OTPs: 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for ChatGPT Plus Billing Phishing Kit: Detection & IOCs →
Chapters
- 0:00The hookChatGPT Plus phishing uses 9 attack techniques.
- 0:04The storyFortra found ChatGPT phishing on rotating WordPress sites under operator control.
- 0:11Attack pathReportedly, operators provision WordPress posing as OpenAI billing.
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromise9 indicators to hunt: 2 domains, 1 URL and 3 file names, and more.
- 0:39MITRE ATT&CK techniques9 ATT&CK techniques, from reconnaissance to impact.
- 0:44Remediation4 steps now: Block observed phishing URLs matching.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00ChatGPT Plus phishing uses 9 attack techniques.
0:05Fortra found ChatGPT phishing on rotating WordPress sites under operator control.
0:12Reportedly, operators provision WordPress posing as OpenAI billing.
0:17Victims submit cards on fake page.
0:19Live operators redirect promising victims to OTP.
0:23OTP codes captured for fraudulent transactions.
0:29No threat actor is attributed. Confidence: low.
0:339 indicators to hunt: 2 domains, 1 URL and 3 file names, and more.
0:409 ATT&CK techniques, from reconnaissance to impact.
0:444 steps now: Block observed phishing URLs matching.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.