VULNpocalypse
MediumEcosystem changeActive

ChatGPT Plus billing phishing kit uses rotating WordPress pages to steal cards and OTPs

Fake OpenAI ChatGPT Plus billing emails lead to disposable nxcli.io checkout pages where a live operator can request bank one-time passwords.

Published
Updated
Exploitation
Yes, Fortra observed a live phishing operation capturing card data and polling for operator instructions; no malware or victim computer compromise was seen

What happened

Fortra researchers documented a phishing operation that impersonates OpenAI with fake ChatGPT Plus billing emails. The emails claim a subscription payment failed and urge recipients to update billing information. The research was published on October 26, 2026, according to Cyber Security News. Both outlets covered it on November 2, 2026.

How the kit works, as reported:

  • Email links pass through tracking services or redirect wrappers before reaching a fake checkout hosted on short-lived WordPress instances on nxcli.io, using random ten-character hexadecimal subdomains (Cyber Security News, GBHackers).
  • The checkout recognizes card brands and formats card numbers, expiration dates and security codes as the victim types (Cyber Security News).
  • After submission, JavaScript sends the card number, expiration date, security code and cardholder name to action.php, then leaves an indefinite loading animation on screen (GBHackers).
  • The browser polls ../panel/classes/processor.php roughly every 500 milliseconds. A human operator can send the victim to an OTP capture page, show an error, or end the session (GBHackers). One test of four minutes and three seconds produced 969 requests, mostly dashboard polling (Cyber Security News).
  • Fortra found identical client-side code and a shared application identifier on independently deployed sites examined about a week apart, which points to a shared template. Sites disappeared and were replaced during the investigation (Cyber Security News).

Limits of what is known:

  • Fortra observed phishing, not malware: no executable download or compromise of victims’ computers was seen (Cyber Security News).
  • WordPress paths in the URLs do not establish exploitation of a WordPress vulnerability (GBHackers). No CVE is referenced in the sources.
  • Whether attackers bought hosting accounts or compromised existing customer sites is unresolved (both sources).
  • Capturing a code could help authorize fraud, but it does not mean every submission produces a successful transaction (Cyber Security News); success depends on the bank’s authentication controls (GBHackers).
  • Cofense separately documented ChatGPT subscription-themed credential phishing using nxcli.io and Google redirect wrappers, but that does not independently prove common attribution or an identical backend (GBHackers).
  • A later, visually different frontend appeared; its relationship to the original backend is not confirmed (GBHackers).

Am I affected?

You are potentially affected if you or your users received a ChatGPT Plus or OpenAI “payment failed” email and clicked through, especially if you entered card details or a bank verification code on a page hosted on a random hex subdomain of nxcli.io.

Indicators reported by Cyber Security News (defanged in the source; re-fang only in controlled tooling):

  • Confirmed hosts: c54b986c1c.nxcli.io (209.87.159.240) and 0b8918640c.nxcli.io (209.87.159.83).
  • Additional hosts: 581c413572, 58f9d9ca90, 38b03ac4e4, 0c859d4565, c7958246e7 and 188f0289b4 (all under nxcli.io); 5fceac40bf.nxcli.io is offline.
  • Redirect domains: authgpt.info, ai-billing.info, mub.me, url-y.uk.
  • URL pattern: https://<10-char-hex>.nxcli.io/wp-admin/<random>/<random>/app/key.php
  • Endpoints and pages: action.php, ../panel/classes/processor.php, token.php, code.php, apv.php?e=ERROR, out.php.
  • Polling parameters: keepAlive, redirectionListener. Card-form field names: cddd, bebeb, gagaga, byebu.
  • Application identifier: 1834f733528e1a9fc930069fa3763a2809d41769.

What to do now

  1. Tell users not to use links in billing emails; verify subscription status by going to ChatGPT directly (GBHackers).
  2. Search mail logs and proxy or DNS logs for the indicators above and investigate matching messages (Cyber Security News).
  3. Filter the observed malicious URLs and review nxcli.io traffic carefully. Avoid blanket blocking, because legitimate customers share the platform (GBHackers).
  4. Detect on recurring page structure and dashboard polling traffic rather than isolated addresses, since sites rotate (Cyber Security News).
  5. If someone submitted card data or a code, contact the bank immediately and report suspicious activity through official support channels (GBHackers).
  6. Report fraudulent hosting (Cyber Security News). When analyzing pages, prefer passive browser inspection; interception-based analysis disrupted the session flow in Fortra’s testing.

Sources