Hackers Use Fake ChatGPT Plus Billing Emails to Steal Credit Card Details and OTP Codes

A phishing campaign impersonates OpenAI by sending fake ChatGPT Plus billing emails claiming failed subscription payments. Victims are directed to fraudulent payment pages hosted on compromised WordPress sites under Nexcess's nxcli.io infrastructure. Attackers monitor submitted credit card details in real time and dynamically request one-time passwords (OTPs) to complete fraudulent transactions. The campaign uses multiple redirect domains and identical client-side code across instances to steal credit card information and OTPs.

• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• North Korea's Crypto Heists Start on the Open InternetMalware2026-10-31
• Hackers Impersonate IT Help Desk on Microsoft Teams to Hijack Active Directory Accounts and Steal DataMalware2026-10-31
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion pathsMalware2026-10-30