ChatGPT phishing campaign targets user credentials

Security researchers at Cofense have identified a phishing campaign that impersonates OpenAI and ChatGPT to steal user credentials and payment information.

The scam utilizes polished emails featuring the official ChatGPT logo, claiming that a subscription payment has been declined. These messages create a sense of urgency by warning recipients they have 48 hours to act.

Emails include an ‘Update Payment Information’ button that directs users to a fraudulent login page designed to look like the legitimate ChatGPT site. The campaign specifically targets account credentials and sensitive financial data.