LiveChat SaaS Abused in Real Time Phishing Campaign Impersonating PayPal and Amazon

Du'aine Davis

Observed in the wild

• Cofense identified an active phishing campaign abusing the LiveChat SaaS platform to impersonate PayPal and Amazon. Users were lured via spoofed refund and “pending order” emails, then socially engineered through real‑time chat to disclose credentials, payment card details, PII, and MFA codes. The campaign targeted individual end users rather than specific organisations, with activity observed during recent Cofense investigations.
• Threat actors used phishing emails containing links to LiveChat-hosted pages (lc[.]chat), creating the appearance of legitimate customer support. Victims were engaged by AI-driven or human-operated chat sessions, redirected to external phishing pages, and prompted to submit login credentials, billing data and MFA codes. This live interaction increased trust and enabled MFA bypass, credential takeover and financial fraud.
• Organisations are advised to use Microsoft Defender for Office 365 to detect phishing with brand impersonation, suspicious SaaS links, and unusual redirect chains. Monitor Defender alerts for MFA fatigue or repeated MFA submissions, block known lc[.]chat abuse indicators, and use Defender for Endpoint to flag anomalous browser activity and credential harvesting behaviour. User awareness training should emphasise live chat–based phishing tactics.

LiveChat Abuse: How Phishers Are Exploiting SaaS Support Tools to Steal Sensitive Data