A sustained phishing campaign impersonating OpenAI billing services delivers fraudulent payment failure notices to a broad audience, primarily English speakers and US-based entities. These messages direct recipients to short-lived, randomly named web instances hosted on a managed WordPress platform, fronted by a content delivery network. The operation relies on a shared, cloned template rather than bespoke infrastructure, allowing the operator to rotate hosts rapidly while maintaining identical functionality. The primary risk is direct financial fraud, as victims are lured into submitting payment card details under the false pretense of resolving a billing issue. The campaign’s low-cost infrastructure and automated deployment model enable sustained, wide-scale targeting without significant technical overhead.
The mechanism centers on a live, human-operated control panel that manages victim sessions in real time. Upon submission, the fraudulent page displays a permanent loading animation while transmitting card data to the server. The client-side code continuously polls the operator’s dashboard for instructions, creating a dependency that defeats proxy-based interception tools by breaking the expected request chain. The operator manually decides whether to escalate the victim to a one-time passcode capture page, display an error, or terminate the session. This design allows the attacker to bypass card-issuer two-factor authentication during the active session. The payload uses obfuscated form field names and randomized path segments to evade pattern-matching detection, while the submitted values remain unencrypted beyond standard transport security, exposing sensitive data to any interception point past the secure layer.[/subscribe_to_unlock_form]
A sustained phishing campaign impersonating OpenAI billing services delivers fraudulent payment failure notices to a broad audience, primarily English speakers and US-based entities. These messages direct recipients to short-lived, randomly named web instances hosted on a managed WordPress platform, fronted by a content delivery network. The operation relies on a shared, cloned template rather than bespoke infrastructure, allowing the operator to rotate hosts rapidly while maintaining identical functionality. The primary risk is direct financial fraud, as victims are lured into submitting payment card details under the false pretense of resolving a billing issue. The campaign’s low-cost infrastructure and automated deployment model enable sustained, wide-scale targeting without significant technical overhead.
The mechanism centers on a live, human-operated control panel that manages victim sessions in real time. Upon submission, the fraudulent page displays a permanent loading animation while transmitting card data to the server. The client-side code continuously polls the operator’s dashboard for instructions, creating a dependency that defeats proxy-based interception tools by breaking the expected request chain. The operator manually decides whether to escalate the victim to a one-time passcode capture page, display an error, or terminate the session. This design allows the attacker to bypass card-issuer two-factor authentication during the active session. The payload uses obfuscated form field names and randomized path segments to evade pattern-matching detection, while the submitted values remain unencrypted beyond standard transport security, exposing sensitive data to any interception point past the secure layer.[emaillocker id="1283"]
The campaign is actively evolving, with instances being replaced throughout the investigation and newer versions showing visually distinct, likely AI-generated front ends. This indicates ongoing development and adaptation rather than a static, one-time deployment. The operator’s motivation is immediate financial gain through card theft and potential unauthorized transactions, rather than long-term espionage or malware deployment. Defensive implications suggest that traditional IP-based blocking is ineffective due to content delivery network fronting and rotating hostnames. Organizations should prioritize behavioral detection, such as monitoring for specific polling patterns and shared application identifiers, alongside infrastructure blocking and direct collaboration with hosting providers to disrupt the operation’s low-cost, repeatable infrastructure.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Resource Development | T1583.006 | Acquire Infrastructure | Web Services |
| Initial Access | T1566.002 | Phishing | Spearphishing Link |
| Execution | T1204.001 | User Execution | Malicious Link |
| Defense Evasion | T1027 | Obfuscated Files or Information | - |
| Credential Access | T1056.003 | Input Capture | Web Portal Capture |
| Credential Access | T1557 | Adversary-in-the-Middle | - |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Command and Control | T1090.002 | Proxy | External Proxy |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Collection | E1056 | Input Capture |
| Command and Control | B0030 | C2 Communication |
| Anti-Behavioral Analysis | B0003 | Dynamic Analysis Evasion |
| Defense Evasion | E1027 | Obfuscated Files or Information |
| Execution | E1204 | User Execution |
| Communication Micro-objective | C0002 | HTTP Communication |
The following reports contain further technical details:
[/emaillocker]