LiveChat Support Tools Abused in SaaS Phishing Scheme

A newly identified campaign shows how Software-as-a-Service (SaaS) platforms like LiveChat are being weaponized to steal sensitive data in real time.

Unlike traditional phishing attacks that rely on fake login pages or static forms, this tactic uses live chat conversations to extract credentials, financial data, and personally identifiable information (PII).

The campaign begins with phishing emails that use social engineering tatics to entice users into clicking on malicious links.

One variant impersonates PayPal, claiming the recipient is eligible for a $200 refund. The message includes a “View Transaction Details” button designed to spark curiosity and financial interest.

Researchers at the Cofense Phishing Defense Center (PDC) have uncovered a phishing operation that abuses LiveChat, a widely used customer support platform, to impersonate trusted brands and interact directly with victims.

Another version uses a more generic approach, informing the user of a pending order that requires confirmation via a “View Update” link. This version creates urgency while leaving out branding, making it harder for recipients to verify legitimacy.

In both cases, clicking the embedded link redirects users to a LiveChat-hosted page using the domain lc[.]chat. These pages are customized to appear as legitimate support portals, often branded as PayPal or Amazon.

LiveChat Enables Real-Time Phishing

Once on the page, victims are prompted to engage in a chat session. The interaction style varies depending on the scenario.

In the PayPal-themed attack, users are greeted by what appears to be an automated chat assistant.

The Amazon-themed variant takes a more manual approach. Victims are connected to a live agent impersonating customer support.

The attacker begins by asking for basic details such as email address, then escalates to more sensitive information including phone number, date of birth, and home address.

The bot quickly directs them to an external phishing site to “complete” the refund process. This site then collects login credentials and triggers a multi-factor authentication (MFA) code, which victims are tricked into submitting.

The conversation is designed to feel legitimate, even including reassurances that the information will be handled securely. However, subtle indicators such as poor grammar and inconsistent punctuation reveal the fraudulent nature of the interaction.

As the chat progresses, attackers request increasingly sensitive data. In the Amazon scenario, victims are told their card details are “not on file” and are asked to provide credit card numbers, expiration dates, and CVC codes for verification.

In the PayPal flow, victims are redirected through multiple phishing pages. After entering login credentials and MFA codes, they are prompted to submit billing details, including unusual fields such as date of birth.

Additional forms request full credit card information and even a second MFA code, enabling attackers to bypass security controls and take over accounts.

This multi-step process allows threat actors to collect a comprehensive dataset that can be used for financial fraud, identity theft, and account compromise.

Evolving Phishing Tactics

This campaign highlights a significant shift in phishing techniques. By leveraging legitimate SaaS platforms like LiveChat, attackers create a sense of trust and immediacy that traditional phishing methods lack. Real-time interaction lowers user suspicion and increases the likelihood of compliance.

Security experts warn that such attacks are harder to detect with automated tools alone, as they blend legitimate services with malicious intent. Human-driven analysis and user awareness remain critical in identifying and stopping these threats.

Organizations are advised to educate users about unexpected support interactions, monitor for suspicious use of third-party platforms, and implement layered security controls to defend against increasingly sophisticated phishing campaigns.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.