LastPass Warns of Fake Maintenance Messages Targeting Users’ Master Passwords

LastPass is alerting users to a new active phishing campaign impersonating the password manager, aiming to trick people into surrendering their master passwords. The campaign began on or around 19 January 2026 and uses phishing emails that claim upcoming maintenance and urge recipients to create a local backup of their password vaults within 24 hours, with subject lines such as LastPass Infrastructure Update: Secure Your Vault Now and Don’t Miss Out: Backup Your Vault Before Maintenance.

The messages direct victims to a phishing site that then redirects to a domain associated with mail LastPass, and LastPass emphasises it will never ask for a master password. It has shared the email addresses from which the messages originate and said it is working with third‑party partners to take down the malicious infrastructure.

According to The Hacker News, a TIME team spokesperson at LastPass described the campaign as a common phishing tactic designed to create urgency, and urged customers to stay vigilant and report suspicious activity. The development follows previous warnings about information‑stealing campaigns targeting LastPass users.