EN PT-BR
← Voltar ao feed
medium technology financial

ChatGPT Plus phishing kit uses rotating nxcli.io WordPress sites with live operator panel to steal cards and OTPs

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 08:56 · coletado há 1 hora

A phishing campaign impersonating OpenAI sends fake ChatGPT Plus billing-failure emails that lead victims to counterfeit checkout pages. Fortra researchers found identical payment forms, obfuscated field names and a hardcoded application identifier across instances captured a week apart, indicating a reusable kit. The pages sit on Nexcess nxcli.io hosting under random ten-character hex subdomains, and operators can manually steer victims to an OTP page, show an error or end the session.

Detalhes técnicos

  • URL pattern: https://<10-char-hex>.nxcli.io/wp-admin/<random>/<random>/app/key.php. The WordPress paths do not indicate a WordPress vulnerability exploit; it is unknown whether attackers created hosting accounts or compromised customer sites.
  • Email links pass through redirect and tracking services before reaching the checkout, allowing individualized links and reuse of the landing page.
  • The form collects card number, expiry, CVC and cardholder name. JavaScript posts them to action.php, and the browser then shows an endless loading animation.
  • The browser polls ../panel/classes/processor.php about every 500 ms for heartbeat and redirect instructions from the operator panel, which can send the victim to OTP collection, show an error or end the interaction.
  • Field names are obfuscated, not encrypted; values are readable by the attacker after TLS termination.
  • Requests from unexpected visitors returned HTTP 400/403, and token-generating URL segments plus session-dependent polling hinder interception analysis. A later, visually different frontend suggests ongoing development.
  • Cofense separately documented ChatGPT subscription-themed credential phishing using nxcli.io and Google redirect wrappers; this shows related abuse but does not prove shared attribution or backend.

Remediação

  • Filter the observed malicious URLs and review nxcli.io traffic carefully; blanket blocking may affect legitimate customers.
  • Verify billing directly through ChatGPT, not emailed links, and check sender addresses and URLs.
  • Victims of unauthorized charges should contact their bank immediately and report to official support channels.

Linha do tempo

  1. gbhackers.com ↗ · pub. 02/11/2026 08:56 · coletado 02/11 10:00 primeiro registro

    ChatGPT Plus phishing kit uses rotating nxcli.io WordPress sites with live operator panel to steal cards and OTPs

    ler a análise desta fonte

    A phishing campaign impersonating OpenAI sends fake ChatGPT Plus billing-failure emails that lead victims to counterfeit checkout pages. Fortra researchers found identical payment forms, obfuscated field names and a hardcoded application identifier across instances captured a week apart, indicating a reusable kit. The pages sit on Nexcess nxcli.io hosting under random ten-character hex subdomains, and operators can manually steer victims to an OTP page, show an error or end the session.

    Technical Details

    • URL pattern: https://<10-char-hex>.nxcli.io/wp-admin/<random>/<random>/app/key.php. The WordPress paths do not indicate a WordPress vulnerability exploit; it is unknown whether attackers created hosting accounts or compromised customer sites.
    • Email links pass through redirect and tracking services before reaching the checkout, allowing individualized links and reuse of the landing page.
    • The form collects card number, expiry, CVC and cardholder name. JavaScript posts them to action.php, and the browser then shows an endless loading animation.
    • The browser polls ../panel/classes/processor.php about every 500 ms for heartbeat and redirect instructions from the operator panel, which can send the victim to OTP collection, show an error or end the interaction.
    • Field names are obfuscated, not encrypted; values are readable by the attacker after TLS termination.
    • Requests from unexpected visitors returned HTTP 400/403, and token-generating URL segments plus session-dependent polling hinder interception analysis. A later, visually different frontend suggests ongoing development.
    • Cofense separately documented ChatGPT subscription-themed credential phishing using nxcli.io and Google redirect wrappers; this shows related abuse but does not prove shared attribution or backend.

    Remediation

    • Filter the observed malicious URLs and review nxcli.io traffic carefully; blanket blocking may affect legitimate customers.
    • Verify billing directly through ChatGPT, not emailed links, and check sender addresses and URLs.
    • Victims of unauthorized charges should contact their bank immediately and report to official support channels.