LastPass Warns of Sophisticated New Phishing Campaign Targeting Users

Post Views: 5

LastPass Users Targeted by Phishing Campaign

A new phishing campaign is targeting LastPass users, attempting to deceive them into surrendering their master passwords. The attackers are using spoofed display names to make the emails appear as if they are coming from LastPass. However, the actual sender address is hidden, and only visible when the recipient expands the email header. This tactic exploits the fact that many email clients, particularly on mobile devices, only display the sender’s name by default.

Phishing Emails and Tactics

The phishing emails claim that the recipient’s account has been compromised or that changes have been made to their master password. The messages urge the user to take immediate action, such as revoking devices, disconnecting and locking their vault, or reporting suspicious activity. The emails contain links to a fake LastPass login page, designed to harvest the user’s master password. This information is highly valuable to threat actors, particularly those motivated by financial gain.

LastPass Response and Mitigation Efforts

LastPass has released indicators of compromise (IoCs) associated with this campaign, including URLs, IP addresses, sender addresses, and subject lines. This is not the first time LastPass has warned users about a phishing campaign. In January, the company alerted users to a backup-themed phishing campaign.

LastPass has been working with Forta Brand Protection to conduct takedown operations and has also collaborated directly with hosting providers to remove the malicious sites. This effort aims to mitigate the impact of the phishing campaign and prevent further compromises.

User Protection and Precautions

The release of IoCs by LastPass enables users to take proactive measures to protect themselves from this campaign. By being aware of the tactics used by the attackers, users can be more vigilant and cautious when receiving emails that appear to be from LastPass. It is essential for users to verify the authenticity of emails and not click on suspicious links or provide sensitive information.