Chatbot Conundrum: Phishing Attempts of OpenAI’s ChatGPT
Threat actors send fake ChatGPT subscription billing emails via a spoofed nxcli.io domain, using a Google API redirect wrapper to a credential-harvesting page mimicking the OpenAI login. A phishing campaign impersonates OpenAI ChatGPT billing notifications, urging recipients to update payment information within 48 hours. The email originates from a non-OpenAI domain and uses a Google API notification redirect URL to reach a fake login page hosted on a separate nxcli.io subdomain, where entered credentials are stolen and exfiltrated.
Detection / Hunteropenrouter
Immediate Actions
- Block emails from 9527db6e1a.nxcli.io and e83cedb076.nxcli.io domains
- Block the Google API redirect wrapper URL at email gateway and proxy
- Quarantine emails with sender domains not matching openai.com referencing billing
Key Takeaways
- Sender address [email protected] impersonates OpenAI support.
- Google API redirect wrapper used to bypass email security gateways.
- Phishing page hosted at e83cedb076.nxcli.io mimics ChatGPT login.
- Legitimate ChatGPT login domain is auth.openai.com.
- Credentials stolen then user redirected to error page.
Attack Chain
- Initial Access: Phishing email impersonating ChatGPT billing sent from spoofed nxcli.io address
- Redirect: Email button links to Google API redirect wrapper URL
- Credential Theft: Redirect lands on fake ChatGPT login page at e83cedb076.nxcli.io
- Exfiltration: Entered credentials stolen and sent to attacker; user shown error page
Affected Systems
- OpenAI ChatGPT user accounts
- Email clients and secure email gateways
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Phishing occurs via browser; EDR sees URL navigation but not page content. |
| Network Visibility | Medium | DNS and HTTP logs reveal nxcli.io domains and Google API redirect URL. |
| Detection Difficulty | Moderate | Google API redirect wrapper may bypass URL filters; nxcli.io domains are detectable. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Emails from nxcli.io subdomains containing billing or subscription language with links to Google API redirect endpoints (T1566.002). | Email gateway logs with sender domain and URL body content. | Initial Access | Low — nxcli.io is uncommon for legitimate billing. |
| Users navigating to e83cedb076.nxcli.io or other nxcli.io subdomains presenting login forms (T1566.002). | Web proxy and DNS resolution logs. | Credential Access | Low — subdomains on nxcli.io are suspicious. |
Required Log Sources
- Email gateway logs
- DNS resolution logs
- Web proxy logs
- URL filtering logs
Key Behavioral Indicators
- Email sender domain mismatch: nxcli.io instead of openai.com
- Google API redirect wrapper URL in email body linking to external site
- Phishing login page URL not matching legitimate auth.openai.com domain
- nxcli.io subdomains hosting PHP login pages
Control Gaps
- Secure email gateways may not block Google API redirect wrapper URLs
- URL reputation feeds may lack coverage for newly created nxcli.io subdomains
False Positive Assessment
Low — nxcli.io domains are not associated with legitimate OpenAI services, and the Google API redirect URL pattern is atypical for billing communications.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Add nxcli.io domain to URL blocklist and DNS sinkhole
- Configure email gateway to flag Google API redirect URLs in message bodies
- Alert on outbound traffic to e83cedb076.nxcli.io
User Protection
- Deploy browser-based anti-phishing extensions that verify login page domains
- Enable MFA on all OpenAI accounts to limit credential reuse impact
Security Awareness
- Train users to verify billing emails come from openai.com domain
- Instruct users to hover over links before clicking and check destination URLs
MITRE ATT&CK Mapping
Initial Access
Collection
Plain-Language Summary
Attackers are sending fake emails that look like ChatGPT billing notices, telling users their payment method needs updating within 48 hours. The email uses a real Google redirect link to slip past security filters and sends victims to a fake login page that looks like ChatGPT. When users enter their username and password, the attackers steal them and show an error page. Anyone who uses ChatGPT with a work or personal account should verify billing emails come from OpenAI and avoid clicking links in unexpected payment notices.
Additional IOCs
- Domains:
9527db6e1a[.]nxcli[.]io- Sender domain for phishing email distribution
- Urls:
hxxps://notifications[.]googleapis[.]com/email/redirect?t=AFG8qyW_Su5LnlMKcIA7MTSSwtdIBp6-pVpWF_Tm7YFcNgju_01zhPKtjCpIcIfTVDTsqk_NT5E4LWD15nZyb_erqoslbxoHKRH8O_TRSdvyON9ZbKAejE3mykvuQ2_t43Pveg7wh8bYrPQvCoCTK_XbSbXSCAsu3vTNbz0XJSMLjnnC....- Google API redirect wrapper URL used to reach phishing page
- domain9527db6e1a[.]nxcli[.]ioSender domain for phishing email distribution
- domaine83cedb076[.]nxcli[.]ioPhishing host serving fake ChatGPT login page
- emailsupport[@]9527db6e1a[.]nxcli[.]ioSpoofed sender address impersonating OpenAI support
- urlhxxps://e83cedb076[.]nxcli[.]io/fertaq/app/key[.]phpPayload URL on phishing server for data exfiltration
- urlhxxps://e83cedb076[.]nxcli[.]io/fertaq/app/login[.]phpCredential harvesting page mimicking ChatGPT login
- urlhxxps://notifications[.]googleapis[.]com/email/redirect?t=AFG8qyW_Su5LnlMKcIA7MTSSwtdIBp6-pVpWF_Tm7YFcNgju_01zhPKtjCpIcIfTVDTsqk_NT5E4LWD15nZyb_erqoslbxoHKRH8O_TRSdvyON9ZbKAejE3mykvuQ2_t43Pveg7wh8bYrPQvCoCTK_XbSbXSCAsu3vTNbz0XJSMLjnnC[.][.][.][.]Google API redirect wrapper URL used to reach phishing page