Fake LastPass maintenance emails target users

According to The LastPass Threat Intelligence, Mitigation, and Escalation (TIME) team, there is an active phishing campaign in which fake “maintenance” emails pressure users to back up their vaults within 24 hours, with the aim of harvesting credentials. The campaign began around January 19, 2026 and the emails claim upcoming infrastructure maintenance, urging recipients to back up their vaults in the next 24 hours.

The emails direct users to a phishing site rather than any legitimate LastPass page, and the link in the message points to a domain, mail-lastpass[.]com, that has been taken down.

LastPass emails in this campaign carry several different subject lines, such as “Scheduled Maintenance: Backup Recommended” and “Important: LastPass Maintenance & Your Vault Security.” The article advises users to ignore such instructions, noting that LastPass will never ask for a master password or demand immediate action under a tight deadline.