{
  "id": 17923535,
  "title": "ChatGPT billing fraud deploys rotating sites for card theft",
  "url": "https://urgent.news/2026/11/03/chatgpt-billing-fraud-deploys-rotating-sites-for-card-theft",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-03T05:50:56.000Z",
  "source": {
    "name": "Arabian Post",
    "slug": "arabian-post",
    "url": "https://thearabianpost.com/chatgpt-billing-fraud-deploys-rotating-sites-for-card-theft/"
  },
  "original_language": "en",
  "account": "Cybercriminals are impersonating OpenAI to steal credit card information by sending fraudulent payment pages to ChatGPT subscribers. These pages, hosted on rotating WordPress websites, capture card details and later demand bank verification codes. A reusable phishing kit, identified by cybersecurity firm Fortra, allows attackers to manage individual victims in real-time. The emails claim a ChatGPT Plus subscription payment failed and instruct recipients to update their billing information. The fraudulent pages request card numbers, expiry dates, security codes, and cardholder names. After submission, the information is transmitted to the attacker's server while the browser repeatedly contacts a control panel for further instructions. The operation distinguishes itself from simple phishing by requesting one-time password verification, which could potentially enable criminals to authorize unauthorized payments, though success depends on the bank's authentication and fraud controls. The investigation identified at least eight hosts within the identified cluster, all using randomly generated, ten-character hexadecimal subdomains under the domain nxcli.io. Fortra found similarities in client-side code, form-field names, and embedded application identifiers across different websites, indicating a shared template rather than separate scams. However, it is unclear whether the criminals opened hosting accounts themselves or gained access to existing customers' websites. Despite using HTTPS connections, the fraudulent pages pose a risk as encryption does not prevent theft of card details from the criminals controlling the server. Researchers also noted unusual field names that obscured the purpose of submitted data and access restrictions that complicated examination of the pages. OpenAI advises customers to verify messages against recognized communication domains and manage billing through their accounts rather than unfamiliar email links. Security teams are recommended to monitor suspicious hosting patterns, filter malicious billing messages, and report abusive sites to providers.",
  "summary": "Cybercriminals impersonating OpenAI are directing ChatGPT subscribers to fraudulent payment pages hosted on rotating WordPress websites, with operators able to demand bank verification codes after capturing card details. Cybersecurity company Fortra identified a reusable phishing kit behind the campaign, documenting identical malicious checkout forms on separate websites and a control panel that…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}