A fake ChatGPT Plus billing alert pushed up to 100,000 emails in a single day

Half of the four named campaigns never touch mail flow. The fake AI Windows plugin was advertised through malvertising and delivered the Vidar stealer ^[6]. The fraudulent DeepSeek installers were distributed through GitHub ^[7]. Microsoft's own description of Safe Links puts its coverage at URL scanning and detonation during mail flow, plus time-of-click verification when a user clicks a link in email, Microsoft Teams or supported Microsoft 365 apps ^[10]. A user who clicks a search ad in a browser, or pulls a binary from a code host, is outside all of that ^[14].

The payoffs also split. The ChatGPT-themed kit was built to harvest credit card data ^[4]. The other three end in identity material or code on the endpoint: the Claude-themed campaign harvested credentials and access tokens through adversary-in-the-middle ^[5], the plugin ad dropped Vidar ^[6], and the DeepSeek installers were executables ^[7]. Three of the four named campaigns produce credentials and access tokens, not card numbers ^[15].

The 100,000 figure is Microsoft's, and it is bounded: up to 100,000 emails in one day, in a campaign that asked users to update ChatGPT Plus payment information and took personal and credit card data ^[2]. Microsoft's post, dated September 10, 2026, gives no campaign duration, no victim count, and no domains or hashes in the text ^[17]. It states plainly that none of this involves a compromise of the AI services being referenced ^[3]. Nothing here requires action inside an OpenAI, Anthropic or DeepSeek account.

The broker model persists after any one campaign ends. Microsoft says an initial access broker it tracks as Storm-3075 used AI-themed malvertising to distribute payloads for multiple downstream actors ^[8]. The lure itself becomes inventory that Storm-3075 resells. The crew building the funnel is not the crew using the access, and the campaigns Microsoft describes layer multi-stage redirection chains and disposable infrastructure, so the domains and the payloads rotate independently ^[9].

For defenders the controls Microsoft points at are already in the tenant. Anti-phishing policies cover user and domain impersonation, first-contact messages and mailbox intelligence signals ^[12]. Safe Attachments detonates attachments in a virtual environment before delivery, and Microsoft's wording is conditional: when policies are configured ^[11]. The bill is a configuration review, plus the ad-click path that mail controls do not see.

Filtering by brand name is the reflex to resist. Three of the four impersonated brands are third-party services; the fourth is Microsoft Copilot ^[16]. A rule that treats AI-vendor notification mail as inherently suspect would also flag mail the tenant generates for itself ^[1].