- BIST10011,722-2.89%
- USD49.45+0.05%
- EUR55.62+0.37%
- GOLD4,181.10+0.26%
- INTEREST37.00%-1.00
- BITCOIN81,433-0.08%
- October 17, 202611°
- BIST10011,722-2.89%
- USD49.45+0.05%
- EUR55.62+0.37%
- GOLD4,181.10+0.26%
- INTEREST37.00%-1.00
- BITCOIN81,433-0.08%
- October 17, 202611°
New phishing campaign targets LastPass users' password vaults
LastPass warned its users about a new phishing campaign that starts with a fake policy update email and directs them to download malware. The attackers aim to access password manager vaults by impersonating trusted brands.
Password manager LastPass announced it has detected a sophisticated phishing campaign targeting its users. The attack aims to trick users into downloading malware via a fake DocuSign page.
The phishing email comes from "hello@lastpassnewsletter.com" and carries the subject line "Action Required: Review Updated LastPass Security Policies." The message is filled with realistic details such as changes to service policies and SaaS monitoring improvements. However, LastPass stated it has no connection to the "lastpassnewsletter.com" domain.
Clicking the link in the email redirects users to a fake DocuSign page at "lastpasscompliance.com." This page is designed to gain the trust of users familiar with electronic signature requests. LastPass announced that Microsoft Defender for Office 365 and Cloudflare have flagged this site as malicious. The page also encourages downloading software that claims to work for both Windows and macOS.
LastPass stressed that the downloaded file is dangerous and should absolutely not be opened. At the time of issuing the warning, the company was still analyzing the download link. While the malicious page may be taken offline once reported, it is noted that attackers can quickly replace blocked domains with new ones.
The attack does not only target LastPass users. Bitwarden customers have also received similar emails from "hello@bitwardennewsletter.com." These messages redirect users to "bitwardencompliance.com." It is believed that the same campaign structure is being reused against different password manager brands. Experts note that password manager users are a particularly attractive target because a stolen master password can provide access to dozens of accounts.
How to protect yourself
- Do not click any link in the email; delete the message or report it as phishing.
- Access your LastPass account only through the official app or the lastpass.com website.
- Carefully check the domain name. Genuine LastPass addresses end with lastpass.com; do not trust domains containing additions like "newsletter" or "compliance."
- If your password manager does not autofill, that is a warning sign. Instead of copying and pasting the password, close the page and log in through the official channel.
- If you have entered your master password, immediately go to LastPass from a trusted device, change your master password, and update the passwords of sensitive accounts in your vault.
- Never download software offered in security notifications that arrive via email. If you have downloaded it, disconnect the device from the internet and scan it with a robust antivirus program.
- Enable multi-factor authentication for your password manager and other important accounts.
- Use data removal services to reduce the personal information that data brokers collect about you.
- Forward suspicious LastPass emails to abuse@lastpass.com. LastPass emphasizes that no employee will ever ask you for your master password.
Experts note that what makes this attack dangerous is the ordinary appearance of the email. Looking like a dull policy update rather than an urgent alert reduces the likelihood of users becoming suspicious. The biggest red flag is the web address. The presence of a company name within a domain does not mean that domain belongs to the company. Before entering your master password or downloading anything, close the email and access your account directly through the official app or website.
Stay Updated with Ally Daily
Subscribe to be informed about special news, developments and announcements. We will keep you informed.
By signing up, you agree to our Privacy Policy
