Brand impersonation: OpenAI with payment issues

  1name: "Brand impersonation: OpenAI with payment issues"
  2description: "Detects messages impersonating OpenAI or ChatGPT with payment-related content such as subscription cancellation, payment failures, or billing updates from non-OpenAI domains."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  and (
  8    // sender or subject contains openai or chatgpt
  9    regex.icontains(sender.display_name, '\bchat\s*gpt\b')
 10    or regex.icontains(sender.display_name, '\bopen\s*a[li]\b')
 11    or regex.icontains(subject.subject, '\bchat\s*gpt\b')
 12    or regex.icontains(subject.subject, '\bopen\s*a[li]\b')
 13    or regex.icontains(body.current_thread.text,
 14                       '(?:regarding\s*your\s*Open\s*A[lI]\s*account|Open\s*A[lI]\s*\.\s*All\s*rights\s*reserved|the\s*open\s*ai\s*team)'
 15    )
 16  )
 17  and 2 of (
 18    // payment phrase
 19    regex.icontains(strings.replace_confusables(body.current_thread.text),
 20                    'update (?:payment method|your (?:billing|payment))'
 21    ),
 22    regex.icontains(strings.replace_confusables(body.current_thread.text),
 23                    'Subscription (?:has expired|(?:will be)?Cancel+ed)'
 24    ),
 25    regex.icontains(strings.replace_confusables(body.current_thread.text),
 26                    'issue with (?:the transaction|(?:your\s)?payment)'
 27    ),
 28    regex.icontains(strings.replace_confusables(body.current_thread.text),
 29                    "you(?:'ll| will) lose access"
 30    ),
 31    regex.icontains(strings.replace_confusables(body.current_thread.text),
 32                    'payment (?:is not successful|error|was declined)'
 33    ),
 34    regex.icontains(strings.replace_confusables(body.current_thread.text),
 35                    'unable to (?:process|automatically charge)'
 36    ),
 37    strings.icontains(strings.replace_confusables(body.current_thread.text),
 38                      'bank or card issuer'
 39    ),
 40    strings.icontains(strings.replace_confusables(body.current_thread.text),
 41                      'issue with the transaction'
 42    ),
 43    strings.icontains(strings.replace_confusables(body.current_thread.text),
 44                      'could not be processed'
 45    ),
 46    strings.icontains(strings.replace_confusables(body.current_thread.text),
 47                      'settle the outstanding'
 48    ),
 49    strings.icontains(strings.replace_confusables(body.current_thread.text),
 50                      'account will be downgraded'
 51    ),
 52    strings.icontains(strings.replace_confusables(body.current_thread.text),
 53                      'Renew Subscription'
 54    ),
 55    strings.icontains(strings.replace_confusables(body.current_thread.text),
 56                      'balance is settled'
 57    ),
 58    strings.icontains(strings.replace_confusables(body.current_thread.text),
 59                      'will renew automatically'
 60    ),
 61    strings.icontains(strings.replace_confusables(body.current_thread.text),
 62                      'process your payment'
 63    ),
 64    strings.icontains(strings.replace_confusables(body.current_thread.text),
 65                      'keep your subscription active'
 66    ),
 67    strings.icontains(strings.replace_confusables(body.current_thread.text),
 68                      'avoid any interruption'
 69    ),
 70    strings.icontains(strings.replace_confusables(body.current_thread.text),
 71                      'charge attempt was unsuccessful'
 72    ),
 73    strings.icontains(strings.replace_confusables(body.current_thread.text),
 74                      'scheduled for cancellation'
 75    ),
 76    strings.icontains(strings.replace_confusables(body.current_thread.text),
 77                      'authorizing your payment'
 78    ),
 79    strings.icontains(strings.replace_confusables(body.current_thread.text),
 80                      'Declining Payment'
 81    ),
 82    strings.icontains(strings.replace_confusables(body.current_thread.text),
 83                      'Insufficient funds'
 84    ),
 85    strings.icontains(strings.replace_confusables(body.current_thread.text),
 86                      'Card has expired'
 87    ),
 88    strings.icontains(strings.replace_confusables(body.current_thread.text),
 89                      'exceeds your credit limit'
 90    ),
 91    strings.icontains(strings.replace_confusables(body.current_thread.text),
 92                      'plan features have been paused'
 93    ),
 94    strings.icontains(strings.replace_confusables(body.current_thread.text),
 95                      'saved payment method'
 96    ),
 97    strings.icontains(strings.replace_confusables(body.current_thread.text),
 98                      'active without interruption'
 99    ),
100    strings.icontains(strings.replace_confusables(body.current_thread.text),
101                      'interruption to your access'
102    ),
103    strings.icontains(strings.replace_confusables(body.current_thread.text),
104                      'review your account status'
105    ),
106    strings.icontains(strings.replace_confusables(body.current_thread.text),
107                      'access confirmation'
108    ),
109    strings.icontains(strings.replace_confusables(body.current_thread.text),
110                      'review allowance'
111    ),
112    strings.icontains(strings.replace_confusables(body.current_thread.text),
113                      'access may be suspended'
114    ),
115    strings.icontains(strings.replace_confusables(body.current_thread.text),
116                      'next allowance cycle'
117    )
118  )
119  // not from openai
120  and not (
121    sender.email.domain.root_domain == 'openai.com'
122    and coalesce(headers.auth_summary.dmarc.pass, false)
123  )
124  // negate highly trusted sender domains unless they fail DMARC authentication
125  and not (
126    sender.email.domain.root_domain in $high_trust_sender_root_domains
127    and coalesce(headers.auth_summary.dmarc.pass, false)
128  )  
129attack_types:
130  - "Credential Phishing"
131tactics_and_techniques:
132  - "Impersonation: Brand"
133  - "Social engineering"
134detection_methods:
135  - "Content analysis"
136  - "Header analysis"
137  - "Sender analysis"
138id: "21732c1d-c4bf-53e4-b0b2-bf9688187af4"