Phishing Alert: Fake ‘LastPass Hack’ Emails Spreading Malware

A phishing campaign impersonating LastPass is circulating, with messages purportedly dated 13 October 2025 that aim to coax users into downloading malicious desktop software. Emails claim to come from “hello@lastpasspulse[.]blog” or “hello@lastpassgazette[.]blog” and carry a subject line warning that users must update their LastPass desktop app to maintain vault security.

The links in the emails lead to malicious domains such as lastpassdesktop[.]com (IP 172.67.147[.]36) or lastpassgazette[.]blog (IP 84.32.84[.]32), while attackers have also pre-registered lastpassdesktop[.]app (IP 172.67.219[.]2) for further phases of the campaign. These domains are hosted on NICENIC, a bulletproof hosting provider used by cybercriminals, and the timing over a U.S. holiday weekend suggests an aim to exploit reduced security staffing.

The article notes indicators of compromise include unusual sender domains, recent domain registrations with little WHOIS information, and the absence of proper TLS certificates on phishing sites, with Cloudflare warning pages already in place to deter victims. LastPass customers are advised not to download unverified updates and to report suspicious emails, while emphasising that no LastPass personnel will request master passwords or prompt for such downloads.