Threat video1:00
ChatGPT Phishing via Google Redirect: Detection & IOCs
Fake OpenAI billing mail routes victims through a Google redirect to a ChatGPT login clone. Includes 9 detection rules (one free in Splunk SPL) and 13 IOCs.
Read the full threat intel for ChatGPT Phishing via Google Redirect: Detection & IOCs →
Chapters
- 0:00The hookPhishing lure impersonates ChatGPT billing, demands urgent payment
- 0:05The storyEmail mimics ChatGPT billing notice
- 0:12Attack pathAttackers craft an urgent payment lure
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise9 indicators to hunt: 3 domains, 2 URLs and 2 file names, and more.
- 0:39MITRE ATT&CK techniques5 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation4 steps now: Block and report sender.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Phishing lure impersonates ChatGPT billing, demands urgent payment
0:05Email mimics ChatGPT billing notice
0:08Redirect leads to fake login and credential theft
0:13Attackers craft an urgent payment lure
0:15Sender impersonates OpenAI support
0:18Email redirects through Google API servers
0:21Then victims see a fake login page
0:23Stealing credentials and payment data
0:28No threat actor is attributed. Confidence: low.
0:339 indicators to hunt: 3 domains, 2 URLs and 2 file names, and more.
0:395 ATT&CK techniques, from reconnaissance to impact.
0:444 steps now: Block and report sender.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.