{"success":true,"data":{"id":"fake-ai-vendor-support-spoof-lure","label":"Fake AI-vendor support / account-verification brand-spoof — \"Your ChatGPT / Claude / Copilot / Gemini account requires verification within 24 hours or access will be suspended\" via lookalike domain harvests AI-vendor account credentials. Sender domain NOT on the AI-vendor canonical allowlist (openai.com, anthropic.com, google.com, microsoft.com, mistral.ai, cohere.com, x.ai, meta.com, perplexity.ai). Air Canada chatbot ruling (BCCRT Feb 2024) + DPD chatbot incident (Jan 2024) + 2025 Microsoft Copilot prompt-injection findings prove jailbroken or hallucinating support bots can issue real commitments, lending the brand-spoof immediate credibility. Distinct from R8 agent-voice-clone (phone modality) — this is email-only. Distinct from R12 #4 (consumer ChatGPT/Claude renewal phish) — this is the support / account-verification spoof. Source: Red-Team R9 multi-agent council S5 (LLM-jailbroken-support specialist), Lead consensus C5.","description":"Fake AI-vendor support / account-verification brand-spoof targeting users of OpenAI / Anthropic / Google AI / Microsoft Copilot / Mistral / Cohere / xAI / Perplexity / Meta-AI consumer or enterprise products. The phish narrative arrives as: \"Your ChatGPT account requires immediate verification. Please verify your AI assistant account credentials within 24 hours or your access will be suspended. Sign in here to verify,\" or \"Anthropic Claude support has flagged your account. Verify your AI assistant credentials immediately or your account will be suspended within 24 hours,\" or \"Microsoft Copilot AI assistant security update requires you to verify your account immediately. Sign in within 24 hours or AI access will be suspended.\" Air Canada chatbot ruling (BCCRT Feb 2024) plus DPD chatbot incident (Jan 2024) plus 2025 Microsoft Copilot prompt-injection findings showed jailbroken or hallucinating support bots can issue real commitments, lending the brand-spoof a credible \"AI customer-support\" framing that did not exist in pre-LLM phishing. Distinct from R8 agent-voice-clone (phone modality) — this is email-only. Distinct from R12 #4 (consumer ChatGPT/Claude renewal phish — the billing pretext) — this signal is specifically the support / account-verification / suspension pretext. Sender domain NOT on the AI-vendor canonical allowlist (openai.com, anthropic.com, google.com, microsoft.com, mistral.ai, cohere.com, x.ai, meta.com, perplexity.ai). Fires when body references ChatGPT / OpenAI / Claude / Anthropic / Gemini / Copilot / Mistral / Cohere / Perplexity / Grok / x.ai / Meta AI / AI assistant / AI account AND contains support / security / verification / verify / account / sign-in / suspended / access / credentials framing AND verify / suspend(ed) / within N hours-days / 24 hours / immediately / urgent / action required / sign in urgency. Excludes the canonical AI-vendor domains. Auto-classified as danger via the `-lure` suffix. Source: Red-Team R9 multi-agent council S5 (LLM-jailbroken-support specialist), Lead consensus C5.","tier":"danger","category":"scam","isThin":false}}