ChatGPT Plus Billing Phishing, Teams Help Desk AD Hijack & AI Platform LLMjacking: OTX Pulse Analysis — Credential Theft Detection Pack

Threat Summary

Three concurrent OTX pulses, all modified 2026-11-02, describe a threat landscape dominated by one objective: credential harvesting at scale, followed by rapid monetization. Although no single named actor links all three campaigns, the tradecraft convergence is unmistakable — social engineering as the entry vector, legitimate infrastructure as the abuse surface, and credentials (payment, identity, and API tokens) as the payload.

Campaign 1 — Fake ChatGPT Plus Billing (Payment + OTP Theft). Operators distribute fraudulent subscription-failure emails impersonating OpenAI billing. Victims land on payment-clone pages hosted on compromised WordPress instances under Nexcess's nxcli.io infrastructure (0b8918640c.nxcli.io, c54b986c1c.nxcli.io) and dedicated phishing domains (authgpt.info, ai-billing.info, url-y.uk). The distinguishing feature is live attacker involvement: operators monitor submitted card data in real time and dynamically trigger OTP/3-D Secure challenges to capture one-time passcodes, enabling immediate card-not-present fraud before the victim's bank can react.

Campaign 2 — Teams Help Desk Impersonation (AD Takeover). Intrusion operators impersonate internal IT help desk staff over Microsoft Teams, convincing users to launch Quick Assist and share connection codes. Once hands-on-keyboard, the attackers deploy portable Python, Bun, and Java runtimes to enumerate the domain, then escalate via Active Directory Certificate Services misconfigurations (ESC1 / ESC8) and PetitPotam coercion, culminating in DCSync-style credential extraction and Rclone-based data exfiltration.

Campaign 3 — Black October LLMjacking. At least nine AI developer platforms (Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, Northflank) were breached during October 2026. Attackers accessed stored environment variables containing AI API credentials, then resold or abused model access through LLM broker infrastructure (31.57.201.201, 38.246.114.118, artex.nhhh.de, direct.465415.xyz). Stolen tokens fuel distillation attacks and agentic abuse at the victim's expense.

Collective objective: convert human trust and misconfigured identity infrastructure into monetizable credentials — payment cards with live OTP, domain admin hashes, and AI API keys — within hours of initial contact.

Threat Actor / Malware Profile

No attributed APT is named in these pulses (all list actor as Unknown), but the tooling profile is diagnostic:

Distribution methods.

• Phishing emails impersonating OpenAI/ChatGPT Plus billing (failed-payment lures).
• Microsoft Teams external/cross-tenant chat messages impersonating IT help desk, pivoting to Quick Assist remote sessions.
• Exploitation of AI developer platform vulnerabilities to read environment variable stores.

Payload behavior.

• The billing phishing kit is operator-in-the-middle: captured card data is relayed live, and OTP prompts are rendered dynamically to intercept 3-D Secure codes.
• The Teams intrusion is LOTL-heavy: rather than dropping bespoke malware, operators stage portable runtimes (Python, Bun, Java), abuse AD CS (ESC1 certificate enrollment abuse, ESC8 NTLM relay to HTTP enrollment endpoints), and run PetitPotam to coerce machine account authentication. Credential theft is executed via DCSync replication abuse; staged data leaves via Rclone to cloud storage.
• The AI platform breaches exfiltrate API keys from environment variables, with stolen tokens brokered through dedicated LLM-proxy infrastructure.

C2 / infrastructure.

• Phishing front-ends ride compromised WordPress on *.nxcli.io (reputation laundering via legitimate hosting), backed by throwaway domains (authgpt.info, ai-billing.info, url-y.uk).
• LLM broker infrastructure uses bare IPs and low-reputation hosts (465415.xyz, nhhh.de subdomains).

Persistence & anti-analysis.

• Persistence in the AD campaign is achieved through rogue certificate issuance (attacker-controlled certs remain valid after password resets) rather than classic implants.
• Portable runtimes leave no installed-software footprint; phishing kits on compromised WordPress blend into legitimate site traffic; LLM token abuse generates no endpoint artifact at all — detection must occur at the identity and API-telemetry layers.

IOC Analysis

The 18 indicators span four types, each requiring a different operationalization path:

• Domains / hostnames (phishing): authgpt.info, ai-billing.info, url-y.uk, 0b8918640c.nxcli.io, c54b986c1c.nxcli.io. Action: block at DNS sinkhole, secure web gateway, and email gateway URL rewrite. Note that nxcli.io is legitimate Nexcess infrastructure — block the specific subdomains, not the parent zone, and alert on any *.nxcli.io resolution from corporate endpoints as hunt logic.
• File hashes (SHA256/SHA1/MD5, 8 total): stageable payloads from the Teams intrusion campaign. Action: push to EDR blocklists and run retro-hunts across DeviceFileEvents / file creation telemetry. Treat MD5/SHA1 as triage-only corroboration; SHA256 is authoritative.
• IPv4 (LLM broker C2): 31.57.201.201, 38.246.114.118. Action: egress firewall block and NetFlow/proxy retro-search — any outbound connection from a developer workstation or CI/CD runner is a high-fidelity compromise signal.
• Hostnames (broker infra): artex.nhhh.de, direct.465415.xyz. Action: DNS-layer blocking plus TLS SNI inspection where available.

Tooling: decode and enrich via OTX pulsed indicator export (STIX/TAXII), MISP, AbuseIPDB for the IPs, urlscan.io and VirusTotal for phishing page screenshots/DOM, and BloodHound + Certify/Certipy output review for the AD CS side. For OTP-interception phishing kits, DOM capture tooling (urlscan, Phishunt) is more valuable than static URL reputation because the pages render benign content until the operator engages.

Detection Engineering

---
title: Quick Assist Execution Following Microsoft Teams Interaction
id: 7f3a9c21-4d5e-4b6a-9c1d-2e8f0a1b3c4d
status: experimental
description: Detects Quick Assist remote session initiation, a key vector in Teams-based IT help desk impersonation campaigns leading to AD compromise, DCSync, and Rclone exfiltration.
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\quickassist.exe'
    selection_parent:
        ParentImage|endswith:
            - '\ms-teams.exe'
            - '\Teams.exe'
            - '\explorer.exe'
    condition: selection_img and selection_parent
falsepositives:
    - Legitimate IT support sessions via Quick Assist
level: high
tags:
    - attack.initial_access
    - attack.t1566
    - attack.t1219
date: 2026/11/03
---
title: Rclone Data Exfiltration Execution
id: 8a4b0d32-5e6f-4c7b-0d2e-3f9a1b2c4d5e
status: experimental
description: Detects Rclone execution with copy/move/sync flags consistent with mass data exfiltration observed in the Teams help desk intrusion campaign.
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\rclone.exe'
    selection_cmd:
        CommandLine|contains:
            - ' copy '
            - ' move '
            - ' sync '
            - '--config'
            - 'mega'
            - 'dropbox'
            - 's3'
    condition: selection_img and selection_cmd
falsepositives:
    - Sanctioned backup tooling (rare in most enterprises)
level: high
tags:
    - attack.exfiltration
    - attack.t1567.002
date: 2026/11/03
---
title: AD CS ESC1/ESC8 Certificate Abuse and PetitPotam Coercion Indicators
id: 9b5c1e43-6f7a-4d8c-1e3f-4a0b2c3d5e6f
status: experimental
description: Detects suspicious certificate requests for authentication templates and PetitPotam-style EFS RPC coercion tooling associated with AD CS privilege escalation.
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools:
        Image|endswith:
            - '\certify.exe'
            - '\certipy.exe'
            - '\PetitPotam.exe'
            - '\SharpCoerce.exe'
    selection_certutil:
        Image|endswith: '\certreq.exe'
        CommandLine|contains:
            - 'WebServer'
            - 'User'
            - '-attrib'
            - 'CertificateTemplate'
    selection_rundll:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains: 'dfscoerce'
    condition: 1 of selection_*
falsepositives:
    - PKI administration by authorized staff
    - Red team exercises
level: critical
tags:
    - attack.privilege_escalation
    - attack.t1649
    - attack.t1187
    - attack.credential_access
    - attack.t1003.006
date: 2026/11/03

// Hunt: Phishing infra, LLM broker C2, and exfiltration behavior across the three campaigns
let PhishDomains = dynamic(["authgpt.info","ai-billing.info","url-y.uk","0b8918640c.nxcli.io","c54b986c1c.nxcli.io"]);
let BrokerIPs = dynamic(["31.57.201.201","38.246.114.118"]);
let BrokerHosts = dynamic(["artex.nhhh.de","direct.465415.xyz"]);
let KnownHashes = dynamic([
    "06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7",
    "85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17",
    "f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001",
    "291db418fb4a6d24c797dc870d5a1cec9a00c0bc",
    "6c4be1f10290e994d926f1270aaf34a6fd3c6ad3"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (PhishDomains) or RemoteUrl has_any (BrokerHosts) or RemoteIP in (BrokerIPs)
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, ActionType
    | extend Hunt = "NetworkIOC"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where SHA256 in (KnownHashes) or SHA1 in (KnownHashes)
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256
    | extend Hunt = "HashMatch"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("rclone.exe","quickassist.exe","certify.exe","PetitPotam.exe")
       or ProcessCommandLine has_any ("dfscoerce","CertificateTemplate","--config")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
    | extend Hunt = "Behavioral"),
    (SecurityEvent
    | where TimeGenerated > ago(7d)
    | where EventID == 4662 and ObjectType == "%schema%" // DCSync replication rights usage
    | where Properties has "Replicating Directory Changes All"
    | project TimeGenerated, Computer, SubjectAccount, ObjectServer
    | extend Hunt = "DCSync")
| sort by TimeGenerated desc

# Security Arsenal - OTX Pulse IOC Hunt (2026-11-03)
# Checks for campaign artifacts: phishing DNS, LLM broker connections, Quick Assist/Rclone, AD CS abuse

$phishDomains = @('authgpt.info','ai-billing.info','url-y.uk','0b8918640c.nxcli.io','c54b986c1c.nxcli.io','artex.nhhh.de','direct.465415.xyz')
$brokerIPs    = @('31.57.201.201','38.246.114.118')
$hashes = @('06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7',
            '85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17',
            'f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001')

Write-Host "[1] DNS cache check for phishing/broker domains..." -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $n=$_.Name; $phishDomains | Where-Object { $n -like "*$_*" } } |
    Select-Object Name, Data | Format-Table -AutoSize

Write-Host "[2] Active/recent TCP connections to broker IPs..." -ForegroundColor Cyan
Get-NetTCPConnection | Where-Object { $brokerIPs -contains $_.RemoteAddress } |
    Select-Object LocalAddress, LocalPort, RemoteAddress, State, OwningProcess | Format-Table -AutoSize

Write-Host "[3] Hash sweep of common staging dirs (Downloads, Temp, ProgramData)..." -ForegroundColor Cyan
$dirs = @("$env:USERPROFILE\Downloads","$env:TEMP","C:\ProgramData","C:\Users\Public")
foreach ($d in $dirs) {
    Get-ChildItem $d -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hashes -contains $h) { Write-Warning "MALICIOUS FILE: $($_.FullName) [$h]" }
    }
}

Write-Host "[4] Rclone / Quick Assist / coercion tooling artifacts..." -ForegroundColor Cyan
Get-ChildItem "$env:APPDATA\rclone","$env:LOCALAPPDATA\rclone" -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime
Get-ScheduledTask | Where-Object { $_.TaskName -match 'rclone|update.*sync|quickassist' } | Select-Object TaskName, TaskPath, State

Write-Host "[5] Suspicious certificate enrollments (potential ESC1 abuse)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4886,4887; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

Write-Host "[6] DCSync indicator - replication events from non-DC accounts..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4662; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Replicating Directory Changes' } |
    Select-Object TimeCreated, Message -First 20 | Format-List

Write-Host "Hunt complete. Escalate any hits to IR immediately." -ForegroundColor Green

Response Priorities

Immediate (0-4 hours). Block all listed phishing domains/hostnames at DNS and SWG; block 31.57.201.201 and 38.246.114.118 at egress. Push the eight file hashes to EDR prevention (not just detect). Disable or restrict Quick Assist (quickassist.exe) via AppLocker/WDAC for all non-support users, and disable external Teams chat with unmanaged tenants pending review. Run the KQL hunt and PowerShell sweep across the fleet.

24 hours. This is credential-theft activity — assume compromise of any touched identity. Force password resets and revoke all sessions/refresh tokens for users who interacted with Teams help-desk chats or billing phishing links. Audit AD CS: enumerate templates vulnerable to ESC1 (ENROLLEE_SUPPLIES_SUBJECT) and ESC8 (HTTP enrollment with NTLM relay enabled); review CA logs (Event IDs 4886/4887) for anomalous certificate requests and revoke attacker-issued certs — password resets alone do not invalidate rogue certificates. For any developer whose platform credentials may have been in a breached AI platform environment variable store, rotate every AI API key (OpenAI, Anthropic, etc.) and audit model-usage billing for anomalies consistent with LLMjacking. Contact affected banks for any cardholder who entered data on the fake billing pages.

1 week. Harden architecture against the observed vectors: enable NTLM relay mitigations (EPA + HTTPS on AD CS web enrollment, LDAP signing/channel binding), restrict certificate enrollment permissions, and deploy Tier-0 DCSync alerting (Event 4662 on replication rights). Move CI/CD and AI platform secrets out of static environment variables into short-lived, workload-identity-bound credentials (OIDC federation) so a platform breach yields no reusable keys. Implement Conditional Access policies blocking token replay, require FIDO2 for help-desk-adjacent roles, and establish a verifiable internal support callback procedure so users can confirm any "IT help desk" contact before launching remote assistance tools.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub