FraudGPT-enabled phishing campaign spoofs ChatGPT subscription service
Cybersecurity researchers identified a phishing campaign impersonating ChatGPT Premium that uses AI-generated emails to deceive users into providing login and financial information. The campaign, facilitated by tools like FraudGPT, reportedly targets users globally with spoofed subscription renewal requests directing them to counterfeit login pages.
What happened
A phishing campaign impersonating OpenAI's ChatGPT Premium subscription service has surged globally, with emails urging recipients to renew a fictional $24 monthly subscription by clicking malicious links.
Symantec identified emails spoofing ChatGPT's branding with subject lines like 'Action Required: Secure Continued Access to ChatGPT with a $24 Monthly Subscription,' directing users to phishing domains such as fnjrolpa.com that host counterfeit OpenAI login pages.
Barracuda Networks observed similar campaigns in late 2024, with over 1,000 emails originating from the unrelated domain topmarinelogistics.com, which passed SPF and DKIM authentication checks despite containing red flags.
Reported impact
The phishing emails are designed to harvest login details and financial information from users by exploiting ChatGPT's widespread adoption and mimicking legitimate OpenAI communications.
Index analysis
Fraudulent AI services like FraudGPT, a dark web derivative of ChatGPT, enable scammers to craft grammatically flawless, contextually convincing emails at scale that bypass traditional detection methods.
Microsoft's 2023 analysis highlighted that AI-generated phishing content now supports over 20 languages, with AI-generated scams eliminating telltale spelling errors that make even savvy users vulnerable.
Governance controls
Cybersecurity teams recommend scrutinizing URLs (authentic OpenAI services use https://chat.openai.com), enabling Multi-Factor Authentication, and conducting regular employee training on identifying AI-driven scams.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.