Phishing scam uses fake death notices to trick LastPass users

LastPass has alerted users about a new phishing attack that claims the recipient has died, with the message saying a family member submitted a death certificate to gain access to the recipient’s password vault. A link in the phishing email leads to a fake page that asks for the LastPass user’s master password, supposedly to stop the request. The campaign is linked to CryptoChameleon (also known as UNC5356), a group that has previously used LastPass branding in phishing kits, including one in April 2024.

The phishing attempt exploits LastPass’s legitimate emergency access feature, which allows designated contacts to request access to a vault if the account holder dies or becomes incapacitated. LastPass also notes that several of the phishing sites are clearly intended to target passkeys, a trend reflecting attackers’ growing interest in passkeys and their adoption by consumers.

To protect themselves, users are advised not to enter their master password on links in emails or texts and to rely on official apps or bookmarks for logging in.