Phishing Campaign Zeroes in on LastPass Customers

An ongoing phishing campaign is targeting customers of password management vendor LastPass. LastPass itself disclosed the campaign via a Jan. 20 blog post, and according to the vendor's Threat Intelligence, Mitigation, and Escalation (TIME) team, attackers began targeting customer vaults on or around Jan. 19, a period that fell over a US holiday weekend.

The emails employ plausible subject lines and credible messages, with attackers allegedly using GenAI to craft them, while some messages still display typos or unusual formatting. The phishing emails lead recipients to a site where they are prompted to enter their login credentials, potentially giving attackers access to the entire vault. A LastPass spokesperson told Dark Reading that there is no indication, at this time, that any accounts were compromised.

The piece also notes that the campaign includes several addresses and subject lines designed to appear legitimate, and urges users to be vigilant and to verify LastPass-branded communications.