// ChatgptMEDIUM
Threat actors are conducting an active phishing campaign impersonating ChatGPT's login interface and sending fraudulent subscription-payment notices from nxcli.io infrastructure. The emails spoof OpenAI's branding and use urgent deadlines to trick users into disclosing credentials and payment details. Cofense Phishing Defense Center identified the campaign using fake endpoints and multi-stage redirect chains to evade detection.
// Get alerts for Chatgpt