Phishing Campaign Exploits LiveChat for Data Theft

A new phishing campaign has been identified that exploits LiveChat to steal sensitive user data by impersonating trusted brands like PayPal and Amazon. Attackers engage victims through real-time chat interactions, coercing them into providing account credentials, credit card details, and other personally identifiable information (PII). The campaign utilizes psychological tactics such as urgency and brand impersonation, with two main attack vectors: one offering a fake refund from PayPal and another prompting users about a pending order. Cofense's Phishing Defense Center discovered this scheme, highlighting the evolution of phishing tactics that make these threats harder to detect. The attackers employ poor grammar and punctuation, indicating a human operator rather than an automated system. This method represents a shift from traditional phishing techniques that typically rely on fake login pages. The campaign is ongoing, with no specific numbers on affected users reported yet.

Key Points: • Attackers are using LiveChat to conduct real-time phishing attacks. • Victims are coerced into providing sensitive information through impersonation of trusted brands. • The campaign demonstrates an evolution in phishing tactics, making detection more challenging.