New Phishing Campaign Exploits LiveChat to Steal Sensitive Data A sophisticated phishing campaign is leveraging LiveChat, a widely used customer service SaaS platform, to deceive victims into surrendering personal and financial information. Unlike traditional phishing attacks that direct users to fake login pages, this operation embeds malicious interactions within legitimate-looking live chat sessions, making detection harder. The campaign targets users through two distinct email lures: 1. A PayPal-themed email claiming a $200 refund, prompting recipients to click a "View Transaction Details" button. 2. A generic order confirmation email urging users to verify a pending order via a "View Update" link, with no brand name visible until after the click. Both emails direct victims to LiveChat-hosted pages under the domain lc[.]chat, where automated chatbots or scripted agents impersonate support representatives from PayPal or Amazon. The PayPal variant uses a chatbot to guide users to a fake login page, capturing credentials and multi-factor authentication (MFA) codes before requesting billing details. The Amazon version collects email, phone number, date of birth, and home address under the guise of identity verification, followed by credit card details for a supposed refund. The attack employs multi-stage data harvesting, with operators using misspelled phrases and awkward phrasing to mimic human interaction. Victims are reassured with false security claims, such as promises of "utmost confidentiality," to encourage compliance. After submitting sensitive data, users are redirected to a confirmation message, obscuring the theft. Security researchers warn that unsolicited refund or order confirmation emails leading to chat interfaces rather than official brand websites should be treated with suspicion. Requests for MFA codes, credit card numbers, or personal details via chat are key indicators of compromise. Organizations are advised to monitor and block traffic to lc[.]chat domains linked to this campaign.