Fake Intercom / Drift customer messaging workspace suspended, live chat offline, chatbot disabled, or support inbox inaccessible due to subscription payment failure phishing

Phishing emails impersonating Intercom or Drift claiming the customer messaging workspace has been suspended, live chat is offline, the chatbot is disabled, or the support inbox is inaccessible due to subscription payment failure — directing victims to update billing through a credential-harvesting portal. A distinct attack category targeting the customer-facing real-time messaging layer that modern SaaS and e-commerce businesses use as the primary interface for customer support, sales, and onboarding: Intercom is the dominant in-app messaging and customer support platform and Drift is the dominant conversational marketing and sales platform. Key facts: (1) Intercom serves 25,000+ businesses (at $74-$374/month per seat Starter-Pro, custom Enterprise) including Atlassian, Shopify, and New Relic as the primary platform for customer support (ticketing and live chat), product tours, onboarding checklists, and targeted in-app messaging — an 'Intercom workspace suspended' email means the live chat widget disappears from every page of the product, automated onboarding messages stop delivering, all support tickets are inaccessible, and the support team loses the ability to respond to any customer inquiry; (2) The live chat offline hook creates immediate customer experience urgency: businesses that rely on Intercom as their primary support channel face the prospect of customers clicking the chat widget and seeing nothing — no response, no offline message, just silence; for SaaS companies whose entire support flow runs through Intercom, this is equivalent to the support team ceasing to exist; (3) Drift serves 5,000+ enterprise customers (at $2,500+/month Enterprise) as the conversational marketing platform where sales teams engage website visitors in real-time — a 'Drift workspace suspended' email means the sales team loses all live chat conversations with prospects at the most critical stage of the sales funnel, all Drift Meetings scheduling links stop working, and all chatbot-qualified leads stop flowing into the CRM; (4) Intercom's position as the customer data hub means credentials expose an extraordinary amount of customer context: every customer's complete conversation history with the support team revealing all product issues and complaints, all user attributes and events tracked in Intercom showing which features each customer uses, all segment configurations revealing how the business categorizes its customer base, all automated message configurations revealing the onboarding and re-engagement strategy, and all Intercom Inbox integrations with Slack, Salesforce, and GitHub Issues; (5) Drift's Sales Hub credentials expose the complete sales intelligence: every prospect conversation and the qualification questions asked, all playbook configurations revealing sales objection handling scripts, all Drift Intel company identification data showing which companies visited the website without converting. Warning signs: sender not intercom.com or drift.com; genuine Intercom billing at app.intercom.com/a/apps/[id]/billing; Drift billing at app.drift.com/settings/billing.