A fake ChatGPT subscription invoice email is being used as a phishing lure to steal credentials for users' OpenAI accounts, targeting both work and personal users. The email is headed "Urgent: Update Your Payment Method to Avoid Service Interruption" and urges victims to pay an outstanding balance of $23.80 within 48 hours. It comes from a fake address, support@9527db6e1a.nxcli.io, rather than an official OpenAI domain, and its "Update Payment Information" button uses a Google API wrapper that redirects to a malicious payload via a webpage where a user could make a sign-in attempt. The redirect leads to a page extremely similar to the genuine ChatGPT sign-in portal, with legitimate logos, text, and icons. Josh Varden of the Cofense Phishing Defense Center said threat actors frequently exploit urgency and perceived trustworthiness to manipulate users into compromising their security. Cofense listed three indicators of compromise: the Google redirect link and two paths on the same nxcli[.]io host, login.php and key.php; hovering over the address bar to check for auth.openai.com would reveal the scam. Cofense said it has identified many similar credential-stealing phish, most commonly spoofing Microsoft, Google, and Adobe. Microsoft Threat Intelligence reported increasing phishing, malvertising, and SEO-driven attacks impersonating AI platforms including ChatGPT, Microsoft Copilot, DeepSeek, and Anthropic's Claude; one campaign consisted of 4,500