Hacker impersonators are using fake ChatGPT Plus billing emails to trick users into visiting payment pages designed to steal credit card details and one-time passwords. The emails contain subscription warnings and a live operator that can request a verification code, potentially allowing unauthorized payments to go through. Researchers identified the same landing page reused across multiple recipients within a sending wave, indicating shared infrastructure behind separately tracked messages.
Similar WordPress payment phishing attempts have used convincing checkout interfaces to steal card data and verification codes, though Fortra could not link them to specific operations. Fortra discovered identical client-side code and a shared application identifier across independently deployed sites, examined roughly a week apart. Researchers noted that interception-based analysis interfered with session flow, whereas passive browser inspection captured payment submission and polling behavior without disrupting it.
Indicators of compromise (IoCs): - Source-reported values: - Confirmed host / IP: c54b986c1c.nxcli.io - Confirmed host / IP: 0b8918640c.nxcli.io - Additional hosts: 581c413572.nxcli.io, 58f9d9ca90.nxcli.io, 38b03ac4e4.nxcli.io - Additional hosts: 0c859d4565.nxcli.io, c7958246e7.nxcli.io, 188f0289b4.nxcli.io - Offline host: 5fceac40bf.nxcli.io - Redirect domains: authgpt.info, ai-billing.info, mub.me, url-y.uk - Landing pattern: https://<10-char-hex>.nxcli.io/wp-admin/
