There is currently a phishing wave targeting users of the password manager LastPass. According to the provider, the fraudulent emails started around Monday of this week.
LastPass is warning this in a current blog post . The fraudulent emails reportedly come from different senders with varying subject lines. They claim that LastPass is performing maintenance and urge users to back up their password vaults within the 24 hours.
LastPass strongly advises that the company does not ask customers to create backups of their vaults in the 24 hours. Instead, it is an attempt by malicious actors to create a sense of urgency in the recipient, “a common tactic for social engineering and phishing emails,” LastPass further writes. The timing is also chosen according to usual tactics and falls on a holiday weekend in the USA. With fewer people working, the discovery of the phishing wave is expected to take longer.
The call-to-action button in the email suggests that it will take victims to a website where they can create a backup of their password vault. In reality, however, those who click it land on the URL “group-content-gen2.s3.eu-west-3.amazonaws[.]com/5yaVgx51ZzGf”, which in turn redirects to the URL “mail-lastpass[.]com”.
“Nobody at LastPass will ever ask for your master password,” LastPass further explains. The company is working with partners to take down these domains as quickly as possible. LastPass customers should remain vigilant and, if in doubt the authenticity of a LastPass email, it is better to send it to the email address abuse@lastpass.com and have it verified there.
LastPass has also compiled some tips for phishing. These include the following email addresses, URLs, and IPs:
The emails carry subject lines such as
LastPass frequently attracts the interest of cybercriminals. For example, in September 2023, there were indications that attackers had copied LastPass password vaults and were attempting to crack them . In early 2024, LastPass then worked on improved security , such as a minimum length of twelve characters for a master password and its comparison with passwords leaked in data breaches.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
