LastPass Users Targeted With Backup-Themed Phishing Emails

LastPass users are being targeted by a backup-themed phishing campaign that began circulating around 19 January, with subject lines referencing maintenance and instructions to back up their vaults. The body of the emails directs recipients to create a vault backup and includes a link to a phishing page hosted on a fake LastPass domain designed to steal master passwords.

Please be advised that LastPass is NOT asking customers to backup their vaults in the next 24 hours; rather, this is an attempt by a malicious actor to generate urgency through social engineering, according to LastPass. The company has shared indicators of compromise to help customers identify and block attacks, noting that the holiday weekend timing is a common tactic to reduce staffing and delay detection.

The article also recalls the 2022 breach, when attackers exfiltrated vault data, and mentions TRM Labs’ December report that threat actors are cracking stolen master passwords to access vaults and drain cryptocurrency wallets.