Cybersecurity company Fortra identified a reusable phishing kit behind the campaign, documenting identical malicious checkout forms on separate websites and a control panel that allows attackers to manage individual victims in real time. Its findings, published on 26 October, show how operators can replace disabled websites without rebuilding the fraud system.
The emails claim that a ChatGPT Plus subscription payment has failed and instruct recipients to update their billing information. Links lead through tracking or redirection services to counterfeit checkout pages that request card numbers, expiry dates, security codes and cardholder names.
Once a victim submits those details, the page displays a persistent loading animation. Behind that screen, the information is transmitted to the attacker’s server while the browser repeatedly contacts a control panel for further instructions.
Fortra found that the page checks for instructions approximately every half-second. An operator can then direct the visitor to a page requesting a one-time password, present an error message or end the interaction. This human-controlled sequence distinguishes the operation from simpler phishing pages that merely collect information and close.
The additional verification step is particularly significant because banks may send one-time codes to confirm online card transactions. Obtaining such a code could help a criminal authorise an unauthorised payment, although the outcome depends on the issuer’s authentication and fraud controls. The investigation establishes the kit’s capability, not a verified number of successful fraudulent transactions.
Researchers traced the counterfeit pages to infrastructure associated with Nexcess, a managed hosting provider within Liquid Web. The sites used randomly generated, ten-character hexadecimal subdomains under the provider’s nxcli. io domain, with varying directory names concealing a common payment collection mechanism.
At least eight hosts were identified within the investigated cluster. Several disappeared while others appeared with matching characteristics. Fortra found identical client-side code, disguised form-field names and the same embedded application identifier on independently deployed websites examined about a week apart.
Those similarities indicate a shared template rather than separate, unrelated scams. However, investigators could not establish whether the criminals had opened hosting accounts themselves or gained access to existing customers’ websites. The presence of WordPress administration paths also does not demonstrate that a WordPress software vulnerability was exploited.
The hosting arrangement enables rapid replacement of individual landing pages. Fortra also observed intermediary links that can direct different recipients towards a shared fraudulent site, separating email distribution from the infrastructure collecting payment information.
The malicious forms use encrypted HTTPS connections, but that protection does not prevent theft. Encryption secures information while travelling to the destination server; it cannot protect card details from the criminals controlling that server. Researchers found that unusual field names obscured the purpose of submitted data without providing additional encryption of its contents.
Investigators also encountered access restrictions that returned error responses to unexpected requests. Session-dependent controls and changing address components complicated examination of the pages. Fortra observed 969 network requests during one test session lasting just over four minutes, largely reflecting communication with the operator’s control system.
A separate investigation by email security company Cofense identified ChatGPT subscription-themed phishing messages using the same hosting domain and redirect techniques. That overlap supports the existence of wider abuse involving similar infrastructure but does not establish that every campaign shares the same operators or software.
OpenAI advises customers to verify messages against its recognised communication domains and to manage billing through their accounts rather than unfamiliar email links. The company says it does not request passwords or verification codes through email, text messages or chats.
Fortra recommends that security teams monitor suspicious hosting patterns, filter malicious billing messages and report abusive sites to providers. It cautions that indiscriminately blocking the entire hosting domain could disrupt legitimate Nexcess customers.
The company also identified a visually different version of the fraudulent checkout during its investigation. Researchers said the changed appearance suggested further development, but they could not confirm whether that version retained the same underlying control system.
OpenAI’s guidance for disputed payments advises affected customers to contact their bank or card issuer promptly and report unauthorised activity through its official support channels. Fortra’s investigation found no executable malware delivered to victims’ devices during the observed phishing interactions.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
