{"success":true,"data":{"id":"fake-chatgpt-plus-subscription-renewal-lure","label":"Fake ChatGPT Plus / Claude Pro / Gemini Advanced / Copilot subscription renewal lure — \"your AI subscription has been canceled, update payment within 24 hours to restore access\" targeting 600M+ paid-AI users; credit-card + AI-vendor credential harvest leads to dark-GPT-as-a-service, conversation history exfil, pivot to linked Google/Microsoft/Apple account","description":"Fake \"your ChatGPT Plus / Claude Pro / Gemini Advanced / Copilot Pro subscription has been canceled — update payment within 24 hours to restore access\" email targeting 600M+ ChatGPT users, 100M+ Claude users, and Gemini Advanced / Copilot Pro subscribers. Harvests credit-card data and OpenAI / Anthropic / Google / Microsoft account credentials. Post-compromise, attackers: (1) run dark-GPT-as-a-service on the victim's paid subscription (attacker-controlled workloads billed to the victim); (2) exfil the full conversation history which frequently contains secrets, API keys, production code, personal health info, and business strategy; (3) pivot to the linked Google / Microsoft / Apple account, unlocking much broader access. Paid-AI is the #1 consumer productivity-tool category by 2026, and the subscription model makes \"renewal failed — update card now\" phrasing maximally credible. Fires when body references ChatGPT / ChatGPT Plus / GPT-4 / Claude Pro / Claude.ai / Gemini Advanced / Copilot Pro / OpenAI / Anthropic / AI subscription AND contains subscription-canceled / payment-failed / restore-access / update-card urgency. Excludes openai.com, chatgpt.com, anthropic.com, claude.ai, google.com, gemini.google.com, microsoft.com, copilot.microsoft.com, stripe.com, paddle.com. Auto-classified as danger via the `-lure` suffix.","tier":"danger","category":"scam","isThin":false}}