Cyberattackers Target LastPass, Top Password Managers

Cyberattackers are exploiting the trust people place in password managers in a wave of phishing campaigns that impersonate LastPass, Bitwarden and 1Password, with the attackers’ aim being to obtain master passwords and access credential stores. In a three-week span, the campaigns targeted users of all three vendors, prompting warnings that enterprise users should be on alert.

The LastPass and Bitwarden phishing messages lured users with claims of a security incident and directed them to links supposedly delivering a safer “new” version or security update, while 1Password activity earlier in the year also involved similar fake breach alerts.

According to BleepingComputer’s analysis, the campaigns used techniques such as masquerading as legitimate emails and deploying compromised software components like Syncro to enable remote access, although master passwords were not extracted in the LastPass/Bitwarden scams. LastPass advised users on 13 October 2025 about the phishing activity, and the piece notes that the threat actor has targeted multiple password managers, leveraging the anxiety surrounding master passwords.

Nate Nelson, contributing writer, reported this on 16 October 2025. According to the article, attackers rely on social engineering to capitalise on users’ trust in password vaults, underscoring the importance of MFA, alerting and cautious handling of password resets.