Cofense’s Phishing Defense Center identified a phishing campaign spoofing ChatGPT and OpenAI billing alerts on September 18, 2026. The fake invoice, according to Cofense, demands a $23.80 balance within 48 hours.
The Brief
- Cofense Phishing Defense Center flagged a fake ChatGPT billing email, per PDC, trying to steal OpenAI account logins.
- Microsoft Threat Intelligence separately tracked a related AI-brand phishing wave, according to Microsoft, hitting up to 100,000 inboxes in a single day across three countries.
- The scam email comes from a lookalike address instead of an official OpenAI domain, then routes through a Google redirect link.
- Threat actors are copying tactics already used against Microsoft, Google, and Adobe logins, according to Varden.
A fake OpenAI invoice hides a credential-harvesting trap
The email is headed “Urgent: Update Your Payment Method to Avoid Service Interruption.” It arrives from a fake sender address at 9527db6e1a.nxcli.io, not an OpenAI domain, PDC found.
With AI growing in popularity over the past few years, it is no surprise that threat actors are beginning to spoof ChatGPT, said Josh Varden of the Cofense Phishing Defense Center. Clicking the payment button first routes victims through a Google API redirect wrapper. It then drops them on a lookalike sign-in page copying OpenAI’s real logos and layout.
PDC pinpointed two endpoints, login.php and key.php, on the same nxcli.io host, as tells. Hovering over the address bar to confirm it reads auth.openai.com exposes the fraud before any password gets typed. The same billing-urgency instinct works against OpenAI’s growing workforce and its expanding subscriber base, which give attackers more plausible billing contacts to imitate.
The scam fits a wider AI-brand phishing surge
Microsoft Threat Intelligence said this summer it was tracking a broader wave of phishing, malvertising, and SEO-poisoning attacks. Those attacks impersonate AI brands including ChatGPT, Microsoft Copilot, DeepSeek, and Anthropic’s Claude.
One billing themed wave in that trend sent 4,500 emails to targets in South Africa. It was part of a larger push into Switzerland and Austria as well.
That spread fits a pattern visible in cybersecurity threat tracking SQ Magazine follows: attackers gravitate toward whichever software brand currently has the largest active user base. A bigger install base simply gives them more plausible billing contacts to spoof.
Cofense’s advice for organizations mirrors standard anti-phishing hygiene. Verify sender domains, hover over payment links before clicking, and reach ChatGPT by typing the official address directly.
None of those steps guarantee immunity. Domain verification and multi-factor authentication help reduce the odds that one convincing invoice turns into a compromised OpenAI account. A single stolen login often unlocks a user’s API keys, saved prompts, and billing history at once.
For defenders, the actionable marker is the domain, not the design. A ChatGPT login page not hosted on auth.openai.com is fake, no matter how convincing its billing subject line reads. The nxcli.io infrastructure PDC identified gives security teams a concrete indicator to block today.
