LastPass Issue Urgent Warning Over New Security Scam To Steal Passwords

LastPass is informing users of an active phishing campaign that started at the beginning of this month, which spoofs official LastPass emails and directs users to a false login page. While directing to a false login page is a common phishing tactic, this new LastPass scam adds an additional layer of deception by creating entire fake email chains to convince users a breach has already happened and that they have to take action quickly. Some basic display name spoofing on top of that, to mask the true email addresses involved, creates a sophisticated phishing scam that tricks users into giving up their master password.


For phishing scammers, successfully fooling victims into handing over access to a password manager is a veritable goldmine. As LastPass' name implies, the purpose of a password manager is to secure all of your services with one unbreakable Master Password, one that could indeed be your "last" one. Unfortunately, LastPass also reflects the weakness of this model after suffering a major security breach in late 2022, where the need for a Master Password was subverted. It wouldn't be a surprise if this attack is related in some way to that previous breach. Hopefully impacted users have since then reset the passwords managed by LastPass and not fallen victim to a phishing scam like this one.

In this case, it's important that all LastPass users remain vigilant of phishing attempts targeted at gaining their Master Password. As LastPass highlights in its own blog post on the matter, no one at LastPass will ever ask for your Master Password. Impacted users or those who are concerned they may be impacted are encouraged to forward those emails to abuse@lastpass.com. While some manual effort is still required to keep a password manager secure, the benefits they offer can far outweigh the negatives, especially if you would typically use the same password across multiple services. As always, proper cybersecurity practices require consistent vigilance, as always.