[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCSIWOfxJle1RuYc9HKD4jJgSXQm-HVFAp2e1krRbUhI":3},{"article":4,"iocs":50,"watch_terms":53,"solutions":54,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"49f55a05-396b-4fe8-91f3-bac93dc2ee84","Hackers Exploit ChatGPT’s Popularity With Fake Billing Notices That Target Credit Cards and OTPs","hackers-exploit-chatgpt-s-popularity-with-fake-billing-notices-that-target-credi-d0ae5c","Hackers are impersonating OpenAI in fake ChatGPT Plus billing emails that lead users to payment pages designed to steal credit card details and one-time passwords. The campaign combines convincing subscription warnings with a live operator who can decide when to request a verification code, potentially helping approve an unauthorized payment. The emails claim a subscription […] The post Hackers Exploit ChatGPT’s Popularity With Fake Billing Notices That Target Credit Cards and OTPs appeared first on Cyber Security News.","A phishing campaign is impersonating OpenAI by sending fake ChatGPT Plus billing emails to users. These emails prompt recipients to update their billing information, leading them to fake payment pages designed to steal credit card details and one-time passwords (OTPs). A live operator can intervene to request verification codes, potentially authorizing fraudulent payments.","Hackers impersonate OpenAI in fake ChatGPT billing emails to steal credit card details and OTPs.","https:\u002F\u002Fcybersecuritynews.com\u002Ffake-billing-notices\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Exploit-ChatGPTs-Popularity-With-Fake-Billing-Notices-That-Target-Credit-Cards-and-OTPs.webp","2026-11-02T11:31:33+00:00","2026-11-02T12:00:28.882494+00:00",8,[17,20,23,25],{"name":18,"type":19},"ChatGPT","product",{"name":21,"type":22},"OpenAI","vendor",{"name":24,"type":19},"WordPress",{"name":26,"type":22},"Fortra","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":27,"icon":29,"name":30,"slug":31},null,"Threat Intelligence","threat-intelligence",[33,38,43,48],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":27,"icon":29,"name":30,"slug":31},[51],{"type":47,"value":24,"context":52},"Fake checkout pages hosted on short-lived WordPress instances.",[21,26,18],{"controls":55,"vendors":137},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":86,"name":87,"problem":88,"products":89},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"slug":115,"name":116,"problem":117,"products":118},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[119,127,132],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":128,"product_name":129,"url":130,"description":131},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":133,"product_name":134,"url":135,"description":136},"core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":150},"fake-chatgpt-billing-emails-harvest-credit-cards-and-otps-via-phishing","Fake ChatGPT Billing Emails Harvest Credit Cards and OTPs via Phishing","Threat actors are exploiting ChatGPT's massive user base by crafting convincing impersonation emails that mimic OpenAI's billing communications, tricking users into surrendering payment card details and one-time passwords on fraudulent pages. The attack is particularly dangerous because live operators intercept OTPs in real time, bypassing multi-factor authentication protections that users may have assumed kept them safe. This incident highlights how brand trust can be weaponized against end users who lack the skills to identify subtle indicators of phishing. When users are not trained to verify sender domains, inspect URLs, and treat unsolicited billing prompts with suspicion, even technically robust security controls can be circumvented through pure social engineering.",[143,144,145,146,147,148,149],"MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","GDPR Article 32","PCI DSS Requirement 6",{"GDPR Article 32":151,"PCI DSS Requirement 6":152,"MITRE ATT&CK T1566: Phishing":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":155,"CIS Control 14: Security Awareness and Skills Training":156,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":157},"The theft of credit card data and OTPs constitutes a personal data breach; Article 32 requires organisations to implement technical and organisational measures — including user training and anti-phishing controls — to protect personal data from exactly this type of attack.","Fake payment pages harvesting cardholder data directly target the payment ecosystem; PCI DSS Requirement 6 mandates security awareness and protective controls around payment processes, including training personnel to detect phishing attempts targeting card data.","This attack is a textbook spearphishing-via-service example where adversaries send fraudulent emails impersonating a trusted brand to harvest credentials and OTPs — exactly the technique T1566 documents and for which it provides detection and mitigation guidance.","While not a software flaw, the procedural gap of not verifying billing communications through official channels represents a human-process vulnerability; SI-2's broader remediation mandate supports closing such gaps through user process controls.","Victims lacked competence in identifying phishing indicators; this clause requires organisations to ensure personnel have the necessary knowledge and skills to recognise social engineering threats, which would have mitigated this campaign's effectiveness.","Users who received the fake billing emails lacked the awareness skills to identify spoofed domains and fraudulent payment pages; a structured security awareness programme would have directly reduced susceptibility to this social engineering attack.","The attack succeeded partly because OTP-based MFA was intercepted in real time; adopting phishing-resistant authentication methods as called for under this control would have prevented fraudulent payment authorisation even after credentials were stolen."]