A Phishing Operation Masquerading as OpenAI
A sophisticated phishing initiative masquerading as OpenAI is employing transient WordPress websites alongside real-time oversight from attackers to expropriate payment card information and possibly intercept one-time passwords.
Deceptive billing emails for ChatGPT Plus alert recipients to supposed subscription payment failures, directing them to fraudulent payment pages where operatives dictate the victim’s subsequent actions.
This operation intricately melds adaptive infrastructure with interactive deceit, allowing the operators to replace blocked sites without reconstructing the foundational attack.
Researchers have pinpointed identical payment forms, obfuscated field identifiers, and a hardcoded application identifier across independently deployed instances observed merely a week apart, offering compelling evidence of a common blueprint.
The counterfeit landing pages are hosted on Nexcess’s nxcli.io infrastructure, utilizing randomly generated ten-character hexadecimal subdomains.
The URLs follow a specific pattern: https://<10-char-hex>.nxcli.io/wp-admin///app/key.php.
Throughout the investigation, numerous sites vanished, only to be replaced by newcomers adhering to the same operational schema.
The question of whether attackers established their own hosting accounts or compromised existing customer websites remains unanswered.
Importantly, the mere presence of WordPress administrative directories in the URL does not signify the exploitation of a WordPress vulnerability; the inquiry reveals phishing deployment rather than a confirmed software exploit.
Email links are routed through redirect and tracking services prior to leading to the fraudulent checkout, allowing operatives to distribute personalized links while maintaining a uniform landing page across different recipients.
Fortra’s examination unveiled a reusable toolkit that functions across rotating websites, rather than isolated phishing pages.
ChatGPT Phishing Kit
The counterfeit payment portal collects the card number, expiration date, CVC, and cardholder name. Upon submission, JavaScript relays this information to action.php, while the browser displays an infinite loading animation.
The page does not autonomously complete payment processing or transition to another screen; rather, the intentional delay conceals an operator-controlled decision.
Simultaneously, the browser polls ../panel/classes/processor.php at intervals of roughly 500 milliseconds. These heartbeat requests maintain the victim’s session, while redirect checks retrieve directives from the control panel.
An operator can redirect the victim to a one-time password collection page, show an error message, or terminate the interaction entirely.
The capture of the issuer’s verification code may facilitate the authorization of fraudulent transactions, albeit success hinges upon the bank’s authentication safeguards.
Utilization of transport encryption does not legitimize this exchange. HTTPS secures the communication channel between the browser and the phishing server; however, submitted card details become comprehensible to the attacker upon TLS termination.
The kit obscures field names instead of encrypting the pilfered values beyond their secure transmission.
Researchers have noted request filtering that yields HTTP 400 or 403 responses for unintended visits. Token-generating URL segments and session-dependent polling posed challenges for interception-based analysis.
These observations suggest mechanisms of traffic gating and vulnerable session requirements, without definitively demonstrating that the kit universally outmaneuvers analysis proxies.
A subsequent frontend with a different visual appearance indicated ongoing development, although its relationship to the original backend remains ambiguous.
Separately, Cofense documented credential phishing themed around ChatGPT subscriptions using the nxcli.io infrastructure and Google redirect wrappers.
This report substantiates related abusive patterns, yet does not independently verify shared attribution or an identical backend.
Organizations are urged to filter identified malicious URLs and meticulously scrutinize nxcli.io traffic, while being cognizant that blanket blocking could inadvertently disrupt legitimate customers.
Users are encouraged to authenticate billing through ChatGPT directly instead of relying on emailed links.
OpenAI recommends verifying sender addresses and URLs; anyone discovering unauthorized transaction activity should promptly contact their bank and report suspicious occurrences through official support channels without delay.
Source link: Gbhackers.com.
