Phishers target 1Password users with convincing fake breach alert

Malwarebytes reports a targeted phishing campaign aimed at 1Password users, including a Malwarebytes employee, to harvest 1Password credentials. The phishing email claimed a breach and urged immediate action, but several red flags were noted: the sender address watchtower@eightninety[.]com does not belong to 1Password, and the button link redirects to mandrillapp[.]com, which is not a legitimate 1Password path.

The attackers even used a feeble domain like onepass-word[.]com to appear legitimate, while the real 1Password communications would come via the official domain or within the app. The campaign appeared to have begun around 2 October, with the domain quickly classified as phishing by several vendors by 3 October, and warnings about the fake form prompting users to enter credentials.

The piece also notes that Hoax-Slayer had reported a similar phishing attempt on 25 September 2025, underscoring the ongoing risk, and it offers practical advice to avoid such scams, including not clicking unsolicited links and going directly to the official 1Password site or app. According to Malwarebytes, indicators of compromise include the email address watchtower@eightninety[.]com and the phishing domain onepass-word[.]com.