# ChatGPT Subscription Payment Phishing Campaign Using Google API Redirect and Fake Login Page

> Cofense Phishing Defense Center reports a phishing campaign impersonating OpenAI/ChatGPT billing notices that urges recipients to update payment information within 48 hours. The button routes victims through a notifications.googleapis.com redirect wrapper to a fake ChatGPT login page on nxcli.io that harvests credentials.

- **Published:** 2026-11-06T02:47:16Z
- **Last reviewed:** 2026-11-06T02:47:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5365
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5365.png
- **ID:** TL-2026-5365
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (2 shown free below)

## Description

Cofense Phishing Defense Center (analyst Josh Varden, published 2026-09-17) documented an email lure titled "Subscription Payment Required" that uses the genuine ChatGPT logo and is signed "The OpenAI Team". The message claims a payment problem and gives the recipient 48 hours to act. Secondary reporting (Help Net Security, Hackread) cites the subject "Urgent: Update Your Payment Method to Avoid Service Interruption" and a $23.80 outstanding balance. The sender is support@9527db6e1a.nxcli.io, which does not match the impersonated brand.

The "Update Payment Information" button does not link directly to the attacker's site. It points to a Google API redirect wrapper (https://notifications.googleapis.com/email/redirect?t=<token>), which forwards the browser to attacker-controlled infrastructure. Because the first hop is a Google-owned hostname, the link can appear more trustworthy to recipients and may weaken URL-reputation checks that rely on the first hostname alone.

The second stage is hosted on e83cedb076.nxcli.io, with the pages /fertaq/app/key.php and /fertaq/app/login.php. The login page mimics the ChatGPT sign-in interface with legitimate logos. When credentials are submitted, the victim is shown an error page while the data is captured by the attacker. Hackread describes the kit as taking username and password. The lure's subject, branding and 48-hour deadline show that the operators are also trying to collect payment information, as Cofense's summary states.

No CVE, CVSS score, malware family or named threat actor is given in the sources. Hackread notes Cofense saw similar patterns in earlier Microsoft, Google and Adobe phishing campaigns. Severity is an analyst assessment. Recommended defensive checks: confirm the sender domain, inspect the real link destination, confirm the address bar shows auth.openai.com before entering credentials, access accounts via bookmarks, change the password if credentials were entered, and use MFA.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1598.003 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ChatGPT Billing Phish Kit Page Access on nxcli.io (/fertaq/app/)** (`TL-2026-5365-SPL-001`)

Detects web-proxy requests to the fake ChatGPT login (login.php) and key.php pages served from nxcli.io under /fertaq/app/ (e83cedb076.nxcli.io). A hit means a user reached the credential and payment-harvesting page of the TL-2026-5365 'Subscription Payment Required' OpenAI billing phish and should be treated as a probable credential exposure.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1598.003, T1204.001, T1657
- **Data sources:** zscaler_web_proxy, defender_device_network_events, defender_url_click_events
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=proxy sourcetype="zscalernss-web" earliest=-24h ```comment: TL-2026-5365 ChatGPT billing phish kit pages on nxcli.io``` | eval url_l=lower(url) | where like(url_l,"%.nxcli.io/fertaq/app/%") OR match(url_l,"^https?://[a-z0-9]+[.]nxcli[.]io/.*/(login|key)[.]php") | stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(action) as actions by user, src | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
````

### Microsoft KQL

```kql
union
  (DeviceNetworkEvents
   | where Timestamp > ago(24h)
   | where RemoteUrl contains "nxcli.io"
   | where RemoteUrl contains "/fertaq/app/" or RemoteUrl has_any ("login.php", "key.php")
   | project Timestamp, Source="DeviceNetworkEvents", Account=InitiatingProcessAccountUpn, DeviceName, Url=RemoteUrl, RemoteIP),
  (UrlClickEvents
   | where Timestamp > ago(24h)
   | where Url contains "nxcli.io"
   | where Url contains "/fertaq/app/" or Url has_any ("login.php", "key.php")
   | project Timestamp, Source="UrlClickEvents", Account=AccountUpn, DeviceName="", Url, RemoteIP="")
| order by Timestamp desc
```

### Sigma

```yaml
title: ChatGPT Billing Phish Kit Page Access on nxcli.io (/fertaq/app/)
id: 5b0c8d1e-7a3f-4c52-9e64-2f1a8b3d7c01
status: experimental
description: Detects proxy requests to the fake ChatGPT login (login.php) and key.php pages hosted under /fertaq/app/ on nxcli.io subdomains, used by the TL-2026-5365 OpenAI billing credential phishing campaign.
references:
    - https://cofense.com/blog/chatbot-conundrum-phishing-attempts-of-openai-s-chatgpt
    - https://helpnetsecurity.com/2026/09/17/chatgpt-phishing-email-openai-password
    - https://intel.threadlinqs.com
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.reconnaissance
    - attack.t1598.003
    - attack.execution
    - attack.t1204.001
    - attack.impact
    - attack.t1657
logsource:
    category: proxy
detection:
    selection_host:
        cs-host|endswith: '.nxcli.io'
    selection_path:
        c-uri|contains: '/fertaq/app/'
    selection_page:
        c-uri|endswith:
            - '/login.php'
            - '/key.php'
    condition: selection_host and (selection_path or selection_page)
falsepositives:
    - Security analysts or sandboxes detonating the published phishing URLs
    - Legitimate unrelated service hosted on nxcli.io (none known)
level: high

```

**Known false positives:**

- Security teams or sandboxes detonating the phishing URLs from the Cofense report
- Threat-intel scanners and URL-reputation crawlers requesting the kit paths

**Tuning notes:** Exclude known analyst/sandbox source IPs and accounts. Adjust index, sourcetype and the url/user field names to your proxy's CIM mapping (e.g. Web datamodel Web.url). Keep the nxcli.io host anchor; for any user hit, reset the password and revoke sessions. DeviceNetworkEvents RemoteUrl is often host-only, so UrlClickEvents gives the path-level match in KQL.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Credential Submission (HTTP POST) to Fake ChatGPT Login on [indicator] (locked: unlock with TL Creds)
- Click-Through on Google Redirect Wrapper from [indicator] Billing Lure (locked: unlock with TL Creds)
- Cloud Sign-In After Exposure to [indicator] Phishing Page (Account Takeover) (locked: unlock with TL Creds)
- DNS Resolution of [indicator] Phishing Infrastructure (locked: unlock with TL Creds)
- [indicator] Landing Page Request with Google Redirect Referer (locked: unlock with TL Creds)
- OpenAI / ChatGPT Brand Display-Name Spoof from Non-OpenAI Domain (locked: unlock with TL Creds)
- OpenAI/ChatGPT Billing Lure from [indicator] Sender (locked: unlock with TL Creds)
- Google API Redirect Hop Followed by [indicator] Landing (Redirect Chain) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 13)

Defanged, TLP:CLEAR.

- Domain: `nxcli[.]io`
- Domain: `notifications[.]googleapis[.]com`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Chatbot Conundrum: Phishing Attempts of OpenAI's ChatGPT (Cofense, Josh Varden)](https://cofense.com/blog/chatbot-conundrum-phishing-attempts-of-openai-s-chatgpt)
- [A fake ChatGPT billing email is after your OpenAI password (Help Net Security)](https://helpnetsecurity.com/2026/09/17/chatgpt-phishing-email-openai-password)
- [Fake OpenAI Billing Emails Target ChatGPT Users in Credential Phishing Scam (Hackread)](https://hackread.com/openai-billing-emails-chatgpt-users-credential-phishing-scam/)
- [ChatGPT Subscription Phishing (Cyber Security News)](https://cybersecuritynews.com/chatgpt-subscription/)
- [Fake ChatGPT Billing Emails Steal Account Logins (MalwareTips)](https://malwaretips.com/blogs/?p=416927)
- [Fake ChatGPT billing emails can steal your login (Fox News)](https://www.foxnews.com/tech/fake-chatgpt-billing-emails-steal-login.amp)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5365