OpenAI Spoofing Scams: How to Counter Phishing Attacks

The popular OpenAI's ChatGPT is continually being targeted by cyber attackers through phishing scams. The scams are planned out to retrieve sensitive user information. These phishing attacks are carefully created using OpenAl or its associated services, playing on the user's trust.

Some of the common OpenAI phishing scams and provide actionable tips for protecting oneself is as follows:

Credential Theft Email Campaign: Masquerading as OpenAI Payments

In the latest OpenAI hacking campaign, hackers sent out many emails stating that the subscription payment for ChatGPT had failed. They told the recipients that they needed to click on an 'update payment details' link. The link took them to a fake version of the actual page on the 'fnjrolpa.​com' domain, where users were compelled to enter login details.

The hackers used an effective scam strategy that bypassed the core email authentication checks of DKIM and SPF thus, appearing legitimate. It affected over 1,000 accounts and was part of a larger credential harvesting campaign as reported by Barracuda Networks.

Protection Tip: Always ensure the domain from which the email was sent exists. Don't click links coming from unsolicited e-mails. However, go directly to the official company website in case the user account gets compromised.

OpenAI Crypto Scam: The Fake Token Giveaway

In another recent OpenAI phishing attack, hackers hacked into the X (formerly known as 'Twitter') account of OpenAI, @OpenAI Newsroom. These hackers posted a fake update of a new cryptocurrency token called $OPENAI. The message posted by hackers declared that all the users on OpenAI could buy a fake OpenAI crypto token in return for participation in beta programs.