{"id":11393,"date":"2026-03-17T10:03:45","date_gmt":"2026-03-17T10:03:45","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/03\/17\/phishers-abuse-livechat-support-tools-to-steal-sensitive-data-in-new-saas-based-attack-tactic\/"},"modified":"2026-03-17T10:03:45","modified_gmt":"2026-03-17T10:03:45","slug":"phishers-abuse-livechat-support-tools-to-steal-sensitive-data-in-new-saas-based-attack-tactic","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/03\/17\/phishers-abuse-livechat-support-tools-to-steal-sensitive-data-in-new-saas-based-attack-tactic\/","title":{"rendered":"Phishers Abuse LiveChat Support Tools to Steal Sensitive Data in New SaaS-Based Attack Tactic"},"content":{"rendered":"

Phishers Abuse LiveChat Support Tools to Steal Sensitive Data in New SaaS-Based Attack Tactic
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A newly identified phishing campaign is turning legitimate customer service software into a weapon for stealing sensitive user data. <\/p>\n

Attackers have been found abusing LiveChat, a widely used Software-as-a-Service (SaaS) platform that businesses rely on for real-time customer support, to carry out convincing phishing operations against unsuspecting victims. <\/p>\n

The campaign marks a clear shift from traditional phishing methods toward ones that feel more personal and harder to detect.\u200b<\/p>\n

Unlike typical phishing emails that drop users onto fake login pages, this approach places victims inside a live chat window, where they believe they are speaking with a real support agent from brands like PayPal or Amazon. <\/p>\n

The setup is designed to make every interaction feel genuine, blurring the line between a real customer service session and a well-crafted trap. <\/p>\n

Victims are drawn in through carefully worded emails promising refunds or order confirmations, with links hosted under LiveChat\u2019s own domain \u2014 lc[.]chat.\u200b<\/p>\n

Cofense researchers identified this campaign<\/a> after analyzing two separate phishing email variants, each carrying a different lure and brand identity. <\/p>\n

The first email spoofed PayPal, notifying recipients of an incoming $200.00 refund and urging them to click a \u201cView Transaction Details\u201d button. <\/p>\n

The second email was more generic, claiming an order was pending and needed confirmation through a \u201cView Update\u201d hyperlink, with no visible brand name until the user clicked through. <\/p>\n

Both emails used social engineering<\/a>: the first preyed on financial curiosity, while the second used urgency and ambiguity to push the user to act.\u200b<\/p>\n

\n
\"Email
Email 1 and Email 2 Body (Source \u2013 Cofense)<\/figcaption><\/figure>\n<\/div>\n

Once clicked, both links led users to separate LiveChat-hosted pages, each impersonating a different brand. <\/p>\n

The PayPal-branded page loaded an automated chat bot that immediately engaged the user, while the Amazon-branded page first asked for an email address before the \u201cagent\u201d appeared. <\/p>\n

\n
\"\"
Email 1 \u2013 LiveChat Prompt (Source \u2013 Cofense)<\/figcaption><\/figure>\n<\/div>\n

Despite different setups, both pages shared the same goal \u2014 to extract as much personal and financial data as possible through what looked like a legitimate customer support session.\u200b<\/p>\n

Multi-Stage Data Harvesting in Action<\/strong><\/h2>\n

Data collection in this campaign unfolded in deliberate, layered steps. In the Amazon version of the threat, the chat agent asked for the user\u2019s email address, phone number, date of birth, and home address \u2014 all framed as routine identity verification. <\/p>\n

The language was noticeably rough, with misspellings like \u201cEllo\u201d and awkward punctuation throughout, suggesting a human operator working from a scripted playbook rather than an automated system.\u200b<\/p>\n

\n
\"Email
Email 2 \u2013 LiveChat Prompt (Source \u2013 Cofense)<\/figcaption><\/figure>\n<\/div>\n

As the chat continued, the agent claimed a $200.00 refund was ready but that the user\u2019s card details were not on file. <\/p>\n

The attacker asked for a full credit card number, expiration date, and CVC \u2014 assuring the user that the information would be handled with \u201cthe utmost confidentiality,\u201d a common tactic used to ease the victim into compliance.\u200b<\/p>\n

\n
\"\"
Email 2 \u2013 LiveChat Harvesting (Source \u2013 Cofense)<\/figcaption><\/figure>\n<\/div>\n

The PayPal variant took a different path. After the chat bot shared an external link, victims were taken to a fake PayPal login page<\/a> where they entered their credentials. <\/p>\n

The attacker captured the MFA code<\/a> sent to the user\u2019s phone, using it to bypass two-factor authentication.\u00a0<\/p>\n

\n
\"\"
Phishing Page and PayPal MFA (Source \u2013 Cofense)<\/figcaption><\/figure>\n<\/div>\n

A billing form followed, requesting the user\u2019s date of birth alongside standard card details \u2014 an unusual combination meant to build a complete financial and identity profile.\u00a0<\/p>\n

\n
\"Email
Email 1 \u2013 Billing Details and CC Information (Source \u2013 Cofense)<\/figcaption><\/figure>\n<\/div>\n

A final MFA prompt<\/a> was presented, and after submission, the victim was redirected to the LiveChat window with confirmation that the refund was on its way.\u00a0<\/p>\n

\n
\"CC
CC MFA and Confirmation Message (Source \u2013 Cofense)<\/figcaption><\/figure>\n<\/div>\n

Users and organizations should treat any unsolicited email about refunds or order confirmations with caution, particularly when it routes through a chat link instead of an official brand website. <\/p>\n

Requests for MFA codes, credit card numbers, or dates of birth through any chat interface are strong red flags that should prompt immediate disengagement. <\/p>\n

Security teams are advised to monitor for outbound traffic<\/a> to lc[.]chat domains and block known malicious URLs tied to this campaign to reduce exposure.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post Phishers Abuse LiveChat Support Tools to Steal Sensitive Data in New SaaS-Based Attack Tactic<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Phishers Abuse LiveChat Support Tools to Steal Sensitive Data in New SaaS-Based Attack Tactic A newly identified phishing campaign is turning legitimate customer service software into a weapon for stealing sensitive user data. Attackers have been found abusing LiveChat, a widely used Software-as-a-Service (SaaS) platform that businesses rely on for real-time customer support, to carry […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-11393","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11393"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=11393"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11393\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=11393"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=11393"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=11393"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}