Skip to navigation

Threat reportPhishingTL-2026-5365

ChatGPT Subscription Payment Phishing Campaign Using Google API Redirect and Fake Login Page

mediumACTIVE

Cofense Phishing Defense Center reports a phishing campaign impersonating OpenAI/ChatGPT billing notices that urges recipients to update payment information within 48 hours. The button routes victims through a notifications.googleapis.com redirect wrapper to a fake ChatGPT login page on nxcli.io that harvests credentials. First disclosed .

Key facts for ChatGPT billing phishing

IdentifiersTL-2026-5365
SeverityMEDIUM
First disclosed
Exploitation statusExploited in the wild
Affected productsOpenAI ChatGPT (brand impersonated; user accounts targeted)
MITRE ATT&CK techniquesT1204.001 Malicious Link, T1566.002 Spearphishing Link, T1598.003 Spearphishing Link, T1657 Financial Theft, T1684.001 Impersonation
MotivationFINANCIAL
Target sectorstechnology, general-consumer, enterprise
Target regionsGlobal
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage for ChatGPT billing phishing

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5365 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ChatGPT Billing Phish Kit Page Access on nxcli.io (/fertaq/app/)

Detects web-proxy requests to the fake ChatGPT login (login.php) and key.php pages served from nxcli.io under /fertaq/app/ (e83cedb076.nxcli.io). A hit means a user reached the credential and payment-harvesting page of the TL-2026-5365 'Subscription Payment Required' OpenAI billing phish and should be treated as a probable credential exposure.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1598.003, T1204.001, T1657
  • Data sources: zscaler_web_proxy, defender_device_network_events, defender_url_click_events
  • Severity: high
  • Confidence: high

Splunk SPL

index=proxy sourcetype="zscalernss-web" earliest=-24h ```comment: TL-2026-5365 ChatGPT billing phish kit pages on nxcli.io``` | eval url_l=lower(url) | where like(url_l,"%.nxcli.io/fertaq/app/%") OR match(url_l,"^https?://[a-z0-9]+[.]nxcli[.]io/.*/(login|key)[.]php") | stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(action) as actions by user, src | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")

Microsoft KQL

union
  (DeviceNetworkEvents
   | where Timestamp > ago(24h)
   | where RemoteUrl contains "nxcli.io"
   | where RemoteUrl contains "/fertaq/app/" or RemoteUrl has_any ("login.php", "key.php")
   | project Timestamp, Source="DeviceNetworkEvents", Account=InitiatingProcessAccountUpn, DeviceName, Url=RemoteUrl, RemoteIP),
  (UrlClickEvents
   | where Timestamp > ago(24h)
   | where Url contains "nxcli.io"
   | where Url contains "/fertaq/app/" or Url has_any ("login.php", "key.php")
   | project Timestamp, Source="UrlClickEvents", Account=AccountUpn, DeviceName="", Url, RemoteIP="")
| order by Timestamp desc

Sigma

title: ChatGPT Billing Phish Kit Page Access on nxcli.io (/fertaq/app/)
id: 5b0c8d1e-7a3f-4c52-9e64-2f1a8b3d7c01
status: experimental
description: Detects proxy requests to the fake ChatGPT login (login.php) and key.php pages hosted under /fertaq/app/ on nxcli.io subdomains, used by the TL-2026-5365 OpenAI billing credential phishing campaign.
references:
    - https://cofense.com/blog/chatbot-conundrum-phishing-attempts-of-openai-s-chatgpt
    - https://helpnetsecurity.com/2026/09/17/chatgpt-phishing-email-openai-password
    - https://intel.threadlinqs.com
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.reconnaissance
    - attack.t1598.003
    - attack.execution
    - attack.t1204.001
    - attack.impact
    - attack.t1657
logsource:
    category: proxy
detection:
    selection_host:
        cs-host|endswith: '.nxcli.io'
    selection_path:
        c-uri|contains: '/fertaq/app/'
    selection_page:
        c-uri|endswith:
            - '/login.php'
            - '/key.php'
    condition: selection_host and (selection_path or selection_page)
falsepositives:
    - Security analysts or sandboxes detonating the published phishing URLs
    - Legitimate unrelated service hosted on nxcli.io (none known)
level: high

Known false positives:

  • Security teams or sandboxes detonating the phishing URLs from the Cofense report
  • Threat-intel scanners and URL-reputation crawlers requesting the kit paths

Tuning notes: Exclude known analyst/sandbox source IPs and accounts. Adjust index, sourcetype and the url/user field names to your proxy's CIM mapping (e.g. Web datamodel Web.url). Keep the nxcli.io host anchor; for any user hit, reset the password and revoke sessions. DeviceNetworkEvents RemoteUrl is often host-only, so UrlClickEvents gives the path-level match in KQL.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Credential Submission (HTTP POST) to Fake ChatGPT Login on [indicator] · unlock with TL Creds
  • Click-Through on Google Redirect Wrapper from [indicator] Billing Lure · unlock with TL Creds
  • Cloud Sign-In After Exposure to [indicator] Phishing Page (Account Takeover) · unlock with TL Creds
  • DNS Resolution of [indicator] Phishing Infrastructure · unlock with TL Creds
  • [indicator] Landing Page Request with Google Redirect Referer · unlock with TL Creds
  • OpenAI / ChatGPT Brand Display-Name Spoof from Non-OpenAI Domain · unlock with TL Creds
  • OpenAI/ChatGPT Billing Lure from [indicator] Sender · unlock with TL Creds
  • Google API Redirect Hop Followed by [indicator] Landing (Redirect Chain) · unlock with TL Creds

Indicators of compromise for ChatGPT billing phishing

As of 2026-11-06, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5365.

Sample indicators (2 of 13)

  • Domain: nxcli[.]io
  • Domain: notifications[.]googleapis[.]com

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

13 indicators of compromise · unlock with TL Creds. Compare plans

How ChatGPT billing phishing works

Cofense Phishing Defense Center (analyst Josh Varden, published 2026-09-17) documented an email lure titled "Subscription Payment Required" that uses the genuine ChatGPT logo and is signed "The OpenAI Team". The message claims a payment problem and gives the recipient 48 hours to act. Secondary reporting (Help Net Security, Hackread) cites the subject "Urgent: Update Your Payment Method to Avoid Service Interruption" and a $23.80 outstanding balance. The sender is support@9527db6e1a.nxcli.io, which does not match the impersonated brand.

The "Update Payment Information" button does not link directly to the attacker's site. It points to a Google API redirect wrapper (https://notifications.googleapis.com/email/redirect?t=<token>), which forwards the browser to attacker-controlled infrastructure. Because the first hop is a Google-owned hostname, the link can appear more trustworthy to recipients and may weaken URL-reputation checks that rely on the first hostname alone.

The second stage is hosted on e83cedb076.nxcli.io, with the pages /fertaq/app/key.php and /fertaq/app/login.php. The login page mimics the ChatGPT sign-in interface with legitimate logos. When credentials are submitted, the victim is shown an error page while the data is captured by the attacker. Hackread describes the kit as taking username and password. The lure's subject, branding and 48-hour deadline show that the operators are also trying to collect payment information, as Cofense's summary states.

No CVE, CVSS score, malware family or named threat actor is given in the sources. Hackread notes Cofense saw similar patterns in earlier Microsoft, Google and Adobe phishing campaigns. Severity is an analyst assessment. Recommended defensive checks: confirm the sender domain, inspect the real link destination, confirm the address bar shows auth.openai.com before entering credentials, access accounts via bookmarks, change the password if credentials were entered, and use MFA.

MITRE ATT&CK techniques by tactic:

Execution

T1204.001 Malicious Link

Initial Access

T1566.002 Spearphishing Link

Reconnaissance

T1598.003 Spearphishing Link

Impact

T1657 Financial Theft

Defense Evasion

T1684.001 Impersonation

Remediation for ChatGPT billing phishing

Immediate actions

  • Block and report sender support@9527db6e1a.nxcli.io and the nxcli.io subdomains 9527db6e1a and e83cedb076 at the mail gateway and web proxy
  • Block URLs hosting /fertaq/app/login.php and /fertaq/app/key.php
  • Search mail and proxy logs for notifications.googleapis.com/email/redirect clicks that landed on nxcli.io
  • Reset passwords and revoke sessions for any user who submitted credentials; contact the card issuer if payment data was entered

Workarounds

  • Add mail-gateway rules flagging billing-themed mail whose sender domain does not match the impersonated brand

Longer-term hardening

  • Evaluate URLs by final redirect destination, not only the first hostname
  • Enforce MFA on OpenAI/ChatGPT and other SaaS accounts
  • Train users to open billing pages via bookmarks and to verify auth.openai.com in the address bar

Affected and fixed versions

  • OpenAI — ChatGPT (brand impersonated; user accounts targeted)

Timeline of ChatGPT billing phishing

  • Per Hackread, Microsoft detected a separate ChatGPT-themed phishing campaign in May 2026 (about 4,500 emails, 97% targeting users in South Africa). Context only; no source links it to this campaign, and the exact day is not stated.
  • Hackread covers the campaign, adding the $23.80 claimed charge, card-data harvesting and the global target scope.
  • Redirect chain documented: locked-ioc-5/email/redirect to locked-ioc-8locked-ioc-9locked-ioc-12 and locked-ioc-9locked-ioc-10, ending in a fake ChatGPT login and an error page after credential submission.
  • Lure observed by Cofense on or before this date: 'Subscription Payment Required' email from locked-ioc-6 with a 48-hour deadline and an 'Update Payment Information' button.
  • Help Net Security reports the campaign, citing the subject 'Urgent: Update Your Payment Method to Avoid Service Interruption' and the locked-ioc-11 sender.
  • Cofense Phishing Defense Center (Josh Varden) publishes analysis of the ChatGPT subscription payment phishing campaign, with IOCs. Exact campaign start date is not stated.
  • Cyber Security News publishes coverage with the sender, redirect and phishing-page IOCs and defensive recommendations.

Sources cited for ChatGPT billing phishing

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats