Crooks impersonate LastPass in campaign to harvest master passwords

LastPass has warned of an active phishing campaign impersonating the service to steal users’ master passwords, with attacks beginning around 19 January 2026. The messages claim urgent maintenance and urge recipients to back up their password vaults within 24 hours, using subject lines about infrastructure updates, vault security, and missed deadlines to coax victims into revealing their master passwords.

The phishing emails are said to originate from several addresses and link to a compromised page hosted on an Amazon S3 domain that redirects to a fake LastPass site. According to LastPass Threat Intelligence, Mitigation, and Escalation (TIME) team, the campaign was launched over a US holiday weekend to exploit reduced staffing and delay detection and response.

LastPass notes it will never ask for master passwords, and urges users to report suspicious messages while it works to take down the malicious domain and share indicators of compromise.