ChatGPT joins Microsoft's phishing nightmare as fake OpenAI scams surge

ChatGPT has entered the top 10 most impersonated brands for the first time, according to Check Point's Q2 2026 Brand Phishing Report.

Branded phishing attempts might sound a bit old-school, especially given Microsoft’s name being commonly used in Windows scams in the 2000s and ensuing years.

Then there were the dodgy clicks, which a sizeable majority of the public became savvy to. Branded scams were feeling a bit outdated until hackers started posing as one of the AI giants to get with the times and modernize their approach.

OpenAI now accounts for 1.1% of all tracked brand phishing attempts, putting it alongside PayPal, WhatsApp, and .

That might not sound like a huge percentage, but it certainly puts ChatGPT on the map as a household brand, and one in which duplicitous behavior can be harnessed through.

For context, Microsoft remains the biggest phishing target at 23%, followed by , Google, Apple, and Amazon.

Together, those 5 brands account for more than half of all phishing campaigns, highlighting just how concentrated attackers' efforts are. The report suggests ChatGPT's rapid rise mirrors its explosive mainstream adoption.

One phishing campaign spoofed ChatGPT Plus billing emails to trick users into handing over their credit card details by copying OpenAI branding and payment failure notifications to make the scam look legitimate.

Victims clicking the email were redirected to a fake payment page designed to harvest financial information. It was that easy.

It found that most phishing attacks start with panic, fake payment failures, urgent security alerts, or account warnings designed to rush victims into clicking.

Users should type OpenAI's web address directly into their browser rather than following email links, the analysts advise.

Check Point says other common warning signs include distorted logos, broken buttons, suspicious domains, and fake social media links.

A convincing-looking ChatGPT email isn't proof that it's genuine – the advice is to always verify the sender and destination URL. Enabling multi-factor authentication can still protect accounts even if passwords are stolen.

The irony is that AI itself is helping scammers produce polished phishing emails at scale, making scams harder than ever to spot.

If something looks or feels even slightly off, verify it through OpenAI's official website, not the message itself.