Hackers Mimic as OpenAI and Sora Services to Steal Login Credentials

Hackers have launched a sophisticated phishing campaign that impersonates OpenAI and the recently released Sora 2 AI service, using cloned landing pages to persuade users to submit login credentials for later harvesting. One site, gotosora2[.]com/pricing, offers tiered plans with pricing that mirrors OpenAI’s portal, while metadata beneath the surface shows Chinese descriptions and keywords.

Victims who select a plan are redirected to fake login forms requesting email addresses and passwords, and are further drawn into supposed “gift” surveys and cryptocurrency scams. The campaign has expanded to non-English domains, including sora2[.]tech which targets Russian speakers with translated text and prompts to try Sora for free, and to lure users into human-verification surveys or paid subscriptions.

After credential harvesting, victims encounter human-verification steps and third-party affiliate redirects, with the attackers promoting counterfeit tokens named SORA2 and $SORA2 that are described as having a supply of 1,000,000,000 with zero taxes and automated liquidity, risking total loss when liquidity pools are drained.

Security researchers note these deceptive domains and advise verifying every URL, navigating directly to official sources, and enabling multi-factor authentication and reputable password managers to mitigate credential harvesting, according to Unit42_Intel. 14 October 2025.