Fake ChatGPT Invoice Email Steals Logins

Attackers are sending fake ChatGPT billing emails that pressure people to “update payment” within 48 hours to avoid service interruption. The message links to a convincing look‑alike ChatGPT login page via a Google redirect, aiming to steal OpenAI credentials.

Key findings

• A fake ChatGPT subscription invoice email is being used to steal OpenAI account credentials.
• The lure uses urgency: victims are told to pay an outstanding balance of $23.80 within 48 hours to avoid service interruption.
• The sender address is not an OpenAI domain (support@9527db6e1a.nxcli.io).
• The “Update Payment Information” button uses a Google redirect that ultimately sends victims to a malicious page resembling the real ChatGPT sign-in portal.
• Indicators of compromise included the Google redirect and two nxcli[.]io paths: login.php and key.php.
• The article notes broader AI-brand impersonation campaigns affecting South Africa, Switzerland, and Austria, including large-scale email volumes.

Who’s being targeted

• Commonly targeted roles: All employees, Finance/Accounts Payable, Executives, IT/Helpdesk.
• Affected industries: Technology, Professional Services, Any business using AI SaaS tools, Consumers / personal email users.
• Attack channels: email, website.
• Impersonated: ChatGPT / OpenAI Billing Support.

Awareness takeaways

• Treat “urgent payment update” messages as high-risk and verify through the official site/app, not the email button.
• Check sender domains carefully, brand names and logos don’t prove legitimacy.
• Hover/check links and confirm you are on the real login domain before entering credentials (e.g., auth.openai.com).
• Assume attackers will imitate popular AI tools (and other big brands) and build training around these look-alike login pages.

Red flags to watch for

• Sender domain is not an official OpenAI domain (nxcli.io).
• Link uses a Google redirect/wrapper before landing on a login page.
• URL does not match the legitimate login host (users should see auth.openai.com).