You might have seen <a href="https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024">this shocking prediction from Gartner:</a> by 2027, 75% of employees will acquire, modify or create technology outside IT&rsquo;s visibility &ndash; up from 41% in 2022.&nbsp;
Your employees rely on more SaaS tools than ever and not all of them are on your radar. &nbsp; 
From cloud apps and browser extensions to AI tools, today&rsquo;s workplaces move fast. And when anyone can implement a new app with little more than a credit card and a dream, you can be sure that very few of them are thinking about access or credential management. Consider this:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Shadow IT and Shadow AI are expanding the attack surface, with unsanctioned tools introducing security gaps no one&rsquo;s monitoring.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">App bloat is costing real money &mdash; small businesses now pay for an average of 134 unused applications, and large organizations pay for 473.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Sensitive data is slipping through the cracks, with 38% of employees admitting they&rsquo;ve shared work information with unauthorized AI tools.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Compliance is harder to maintain when there&rsquo;s no clear picture of who&rsquo;s accessing what, and from where.&nbsp;</li>
</ul>
Single sign-on (SSO) can help with your core apps-- the ones that you know about-- but it doesn&rsquo;t cover everything, especially those smaller, hidden apps. And for small and mid-sized businesses, controlling those can get expensive and time-consuming, fast.&nbsp;&nbsp;
That&rsquo;s where the security gaps start. Without a simple, customizable way to manage access, secure credentials and monitor app usage, it&rsquo;s easy to lose control. And that opens the door to risk from old accounts that still have access to sensitive info, to apps no one remembers signing up for.&nbsp;
It&rsquo;s no longer enough to secure passwords alone. Businesses need an approach to identity and access management that&rsquo;s as flexible, efficient, and user-friendly as the tools their employees actually use.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">What is Secure Access Experiences?&nbsp;&nbsp;</h2>
Secure Access Experiences is the LastPass answer to this growing access management crisis &mdash; an evolving approach designed to bring together essential capabilities into one intuitive experience. It helps you control who has access to what, based on your own policies &mdash; not just passwords. Whether your team is using approved tools or ones you didn&rsquo;t even know about, you&rsquo;ll get the visibility and control you need, all in one easy-to-use solution.&nbsp;
With Secure Access Experiences, you will be able to:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Log in with ease: Securely manage how your team stores and uses passwords. Support for passkeys makes logging in even faster and safer.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Control who gets access: Make sure the right people have access to the right apps, systems, and data&mdash;nothing more, nothing less. It&rsquo;s easy to set up and adjust as your business grows.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">See what&rsquo;s happening: Know which apps your team is using, when, and how. Stay informed, spot issues early, and feel confident that everything&rsquo;s running smoothly.&nbsp;&nbsp;&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Why do Secure Access Experiences matter?&nbsp;</h2>
As SaaS adoption grows and the lines between personal and professional tools blur, businesses need a smarter, simpler way to manage access &mdash; one that meets modern challenges head-on, without overwhelming teams or breaking the bank.&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Grows with your business: As your business adds more tools, people, and locations, LastPass makes it easy to keep everything secure without slowing you down.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Easy to manage, easier on your budget: Control access to all your tools from one place. Less hassle for you, and no need to invest in multiple systems.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Provides better protection, fewer headaches: Keep your business safe with strong, simple security&mdash;and make it easier to meet industry requirements along the way.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Simple for your team to use: When it&rsquo;s easy to use, your team actually uses it. That means stronger habits, less risk, and happier employees.&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">It starts with SaaS Monitoring.&nbsp;</h2>
You can&rsquo;t control what you can&rsquo;t see. That&rsquo;s why the first capability in Secure Access Experiences is SaaS Monitoring &mdash; expected in mid-May and delivered via the same browser extension already trusted by millions for password management.&nbsp;&nbsp;
<img src="https://cdn.lputil.com/-/media/2b6fd9bba92346a8a0fcedeca39eed06.png?h=824&amp;w=1250" >
<p class="Paragraph SCXW34306727 BCX0" paraid="543943140" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{232}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">With SaaS Monitoring, business owners and IT admins can finally see what apps are being used across their organization, helping them detect unapproved tools, spot Shadow IT and Shadow AI, and optimize application investments &mdash; all without the need to deploy extra agents, integrations or complexity.
<p class="Paragraph SCXW34306727 BCX0" paraid="713470910" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{238}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">Want to see the future of easier visibility and control? If you&rsquo;re attending RSA, stop by Booth 1449 in the South Expo at RSAC 2025 to see SaaS Monitoring in action. Get hands-on with live demos, hear from our experts, and see what&rsquo;s next for Secure Access Experiences with LastPass.
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>

Introducing Secure Access Experiences: Controlling the Chaos of Modern App Sprawl

Secure Access Experiences is the LastPass answer to this growing access management crisis.

Why so many smart people fall for baiting attacks and how to spot the traps they miss

We demystify baiting, explain why it’s exploding, and provide actionable tips on how you can protect yourself (and your loved ones).  

Why So Many Smart People Fall for Baiting Attacks — and How to Spot the Traps They Miss

Microsoft Authenticator Alternatives

f you’re currently researching Microsoft Authenticator alternatives, we’ll show you how to find your new digital fortress ahead of Microsoft’s deadlines. 

Microsoft Authenticator Alternatives: What the Pros Use (and You Should Too)

SaaS Monitoring: Four Ways to Close the Credential Security Gap Today

We reveal four ways to achieve effective credential security, so you can protect your business, data, and reputation.

The hidden world of pharming attacks and the simple ways to stay safe

We break down the latest pharming stats, show you exactly how these attacks happen, and give you a clear, actionable plan to stay safe. 

Are You Visiting the Real Website? The Hidden World of Pharming Attacks and the Simple Ways to Stay Safe

&ldquo;Each digital interaction&mdash;whether personal or professional&mdash;represents a different identity. Managing them securely and easily is essential.&rdquo; &mdash; Karim Toubba, CEO, LastPass&nbsp;
In our digital-first world, every login is a potential attack vector. As cyber threats grow more sophisticated, identity has become the new frontline of defense. &nbsp;
This was the central message in a recent conversation between Karim Toubba, CEO of LastPass, and Yorn Ziesche, Director IT Security &amp; Compliance at Handelsblatt Media Group, during a special session on the future of digital identity at WiWo Cyber Protection Day.&nbsp;
<h2>Identity: The Last Firewall</h2>

&ldquo;Even after patching every vulnerability, the identity remains the one element that still has access to everything.&rdquo; &mdash; Yorn, IT Director, Handelsblatt&nbsp;
Even with the best infrastructure and patched vulnerabilities, one element remains persistently exposed: identity. Whether it&rsquo;s a journalist accessing editorial systems or a developer logging into cloud services, identity is the key to everything&mdash;and the most common target for attackers.&nbsp;
Learn why Handelsblatt uses LastPass:&nbsp;
<iframe width="560" height="315" src="https://www.youtube.com/embed/vBeEv4OvhaM?si=s-3YEslRHlNpznor" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe>
<h2>Introducing LastPass SaaS Monitoring: Securing Identities Beyond Your Visibility</h2>

As identity becomes more complex, so must the tools we use to manage it. That&rsquo;s why LastPass is evolving beyond password management with the launch of <a rel="noopener noreferrer" href="https://blog.lastpass.com/posts/%20clarity-not-chaos-take-back-control-with-lastpass-saas-monitoring" target="_blank">LastPass SaaS Monitoring</a>, the new functionality in our Secure Access Experiences,&nbsp;our approach to making access management more accessible for everyone.&nbsp;.&nbsp;
LastPass SaaS Monitoring is an extension of securing identities. It enables visibility into both applications and the identities using them, helping organizations detect risk, enforce access policies, and close off unauthorized or risky environments. This transparency allows IT teams to:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Detect shadow IT and shadow AI&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Understand who is using what apps&mdash;and why&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Secure identities within those environments&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Reduce unnecessary software spend&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Enforce security policies more effectively&nbsp;</li>
</ul>
By combining SaaS visibility with identity and access management (IAM), LastPass helps organizations move from reactive protection to proactive identity governance.&nbsp;
<h2>Final Thoughts: Know Your Identity, Know Your Risk</h2>

Whether you&rsquo;re a global media house or a growing startup, the message is clear: you can&rsquo;t protect what you can&rsquo;t see. Identity is no longer just a login&mdash;it&rsquo;s the foundation of trust, access, and security.&nbsp;
With tools like LastPass and innovations like LastPass SaaS Monitoring, organizations can finally bridge the gap between protection and perception&mdash;and build a future where identity is not just managed but mastered.&nbsp;
Learn how LastPass can help your organization secure what matters most&mdash;your identities.&nbsp;Contact our Sales team to get a free demo of LastPass Monitoring.
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/contact-sales" target="_blank"><button class="lp-button lp-button--primary">Get in touch</button></a></div>
And watch the full conversation between Karim Toubba and Yorn Ziesche below:
<iframe width="560" height="315" src="https://www.youtube.com/embed/DSsYPlY1gg0?si=n929_Zk_npqFi9Uy" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe>

Stop Managing Passwords, Start Securing Identities 

Learn how LastPass can help your organization secure what matters most—your identities.

Stop Managing Passwords. Start Securing Identities.

One chapter in the saga of infostealer malware has ended&mdash;at least for now&mdash;after a global law enforcement takedown of Lumma Stealer in mid-May. US, European, and Japanese authorities, with the help of tech companies including Microsoft and Cloudflare, took down, suspended, and blocked approximately 2,300 malicious domains that made up part of the infostealer&rsquo;s backbone. The FBI also seized domains that served as login panels allowing other criminals to access and use the infostealer. Although, this seizure is intended to effectively prevent criminals from being able to access Lumma to compromise computers and steal data, the overall stealer threat will remain prevalent for the foreseeable future. 
(Interested in learning more about the infostealer threat outlook? Read the LastPass TIME team&rsquo;s threat predictions and analysis on <a href="https://blog.lastpass.com/posts/2025-cybersecurity-trends">what direction infostealers and other threats are heading</a>.) 
<h2>What is Lumma?</h2>
 
Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022. Since its initial release, Lumma&rsquo;s developers have released multiple upgraded versions of the software. Before the malware-as-a-service (MaaS) platform was dismantled, the FBI linked Lumma to around <a href="https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted">10 million infections</a> globally. Lumma&rsquo;s follow-on attacks involving stealing credentials, cryptocurrency data, and credit card information have resulted in an estimated <a href="https://cyberscoop.com/lumma-infostealer-widespread-victims/">$36.5 million USD</a> in credit card theft in 2023. The malware hit individuals and a wide range of industries, including Fortune 500 companies, airlines, universities, banks, and hospitals. 
What makes this stealer particularly effective is that it continues to evolve to bypass security layers even as defenders are responding to the threat. On top of grabbing browser-stored passwords and cookies, it&rsquo;s also capable of extracting autofill data, email credentials, File Transfer Protocol (FTP) data, and two-factor authentication tokens and backup codes. Using its MaaS platform, its creators sold access to the malware on multiple underground markets and platforms like Telegram. 
<h2>What comes next?</h2>
 
This takedown is a major win for law enforcement and will help disrupt the initial access broker ecosystem in the near term. However, this is an ecosystem that has demonstrated its resilience again and again. The number of existing infostealer families, the open access to numerous source codes of previous infostealers, and the constant demand create a lucrative environment with very low barriers to entry. Given the resiliency of this market, other infostealer will likely quickly step in and fill in the gaps left after the Lumma takedown. 
A similar pattern previously played out with other similar takedowns. On October 28, 2024, Operation Magnus disrupted the RedLine and META infostealers. RedLine was a significant stealer last year up until the takedown, after which Lumma grew in popularity and took over a portion of the market share previously held by RedLine. Redline infected 9.9 million hosts, or 43% of all infostealer infections observed by Flashpoint in 2024. The next four most-prolific infostealers in 2024, including RisePro, SteaC, Lumma Stealer, and Meta Stealer, infected a <a href="https://cyberscoop.com/infostealers-cybercrime-surged-2024-flashpoint/">combined 7 million hosts</a>. 
We expect to see something similar following the Lumma Stealer takedown operation. The disruption effect following takedown is real, but there are still some new infections and logs for sale that were likely stolen before the infrastructure was taken down. Additionally, just because Lumma&rsquo;s infrastructure was dismantled, a lot of the data it stole likely continues to live on the dark web&mdash;thanks to the cybercriminal ecosystem that resells this information. Additionally, <a href="https://blog.checkpoint.com/security/lumma-infostealer-down-but-not-out/">CheckPoint</a> reported Lumma&rsquo;s developers are already trying to rebuild and restart their operations, which may or may not be successful.&nbsp;As SpyCloud&rsquo;s <a href="https://www.linkedin.com/posts/thilligoss_lummatakedown-lummareallynowork-stealc-activity-7332888157480198146-u94p">Trevor Hilligoss shared</a>, daily new Lumma infections have trended downward following the takedown but not as much as expected. Continued monitoring will be necessary to determine the takedown&rsquo;s impact. 
Long-standing groups such as Vidar and Stealc are good examples of this, but other newer families, such as Acreed, will also be well positioned to increase their market share. <a href="https://www.bleepingcomputer.com/news/security/russian-market-emerges-as-a-go-to-shop-for-stolen-credentials/">ReliaQuests</a> already reported Acreed is rapidly gaining traction following the Lumma takedown. <a href="https://webz.io/dwp/acreed-infostealer-everything-we-know-so-far/">Over 4,000 logs</a> stolen by Acreed were reportedly uploaded to the Russian Market within its first week of operations.&nbsp;Nexus has also gained some traction over the last week in Lumma&rsquo;s absence. Further, former affiliates and/or administrators associated with Lumma itself may split off to create their own offerings.

<img src="https://www.lastpass.com/-/media/ffef2d4ef9d544babc2169a6d0274059.jpg?h=310&amp;w=624" >&nbsp;
Daily new LummaC2 infections (Source: Trevor Hilligoss)
<h2>How to protect yourself against infostealers</h2>
The threat from infostealers will remain very real for the foreseeable future and continue to adapt. Oftentimes, stealers are used in indiscriminate campaigns. Additionally, the sheer volume of data that has been dumped on the internet is immense. That means anyone is fair game and should take action to protect themselves following that assumption that they could be targeted. 
<ul>
 <li>Use strong, unique passwords for every account. This will prevent credential stuffing attacks, which is a common tactic where threat actors insert stolen usernames and passwords. That way, if one password is exposed, it won&rsquo;t give access to all your other accounts where you reuse the same password. Also, consider using a password manager to securely and conveniently store them.</li>
 <li>Enable MFA on your accounts. While this measure isn&rsquo;t failproof on its own, it adds an additional layer of defense and makes you a harder target.</li>
 <li>Be on guard for phishing attempts. Infostealers often spread through phishing emails and malicious downloads. </li>
 <li>Check HaveIBeenPwned to monitor potential exposure if you&rsquo;re worried you may have been infected by an infostealer. </li>
</ul>

What the Lumma stealer takedown means for the infostealer market and your personal data

Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Mobile wallet security 101: How to keep hackers out and make digital life safer

This article breaks down the latest strategies on how to safeguard your money and data in the digital age. 

Mobile Wallet Security 101: How to Keep Hackers Out and Make Digital Life Safer 

Email spoofing: What hackers hope you miss in 2025

We reveal the latest email spoofing tactics, highlight the clues most people miss, and equip you with powerful strategies to stop email spoofing – before it reaches your inbox.  

Email Spoofing: What Hackers Hope You Miss in 2025

Join LastPass in London at Infosecurity Europe 2025

LastPass will be at Infosecurity Europe from 3-5 June 2025 at ExCel London.

Identifying Tech Support Scams

Tech support scams continue to thrive. We pull back the curtain on the tactics attackers are using today – and provide real insights on how to protect your loved ones.

How Tech Support Scammers Are Targeting Seniors — and What to Do About It

Protect against business email compromise in 2025

Learn easy, practical steps you can take right now to protect everything you’ve built from business email compromise.

Protect Against Business Email Compromise in 2025

As we approach the midpoint of the year, the cybersecurity landscape continues to evolve at a rapid pace. Emerging threats, fueled by advancements in AI, increased geopolitical tensions, and the growing complexity of digital infrastructure, have already shaped the first half of the year. From sophisticated ransomware campaigns to supply chain attacks and the rise of deepfake-enabled social engineering, the cyber threat landscape is becoming more complex and fast paced, posing new challenges to defend against these threats. Identity-based attacks have also become a huge focus, playing a central role in a lot of recent cyber activities. This unprecedented threat environment makes having a security-first focused mindset more critical than ever.
Here at LastPass, one of our key priorities is to stay ahead of evolving threats and tactics used by malicious actors to keep our customers and organization secure. We wanted to share some insights from our look back at the year so far and our predictions for the rest of the year ahead and beyond.
<h2 style="color: #000000; margin: 0in 0in 8pt;">The use of AI and adjacent technologies will continue to evolve, with LLMs and deepfakes combining in order to power fraud and ATO attacks.</h2>
While AI generated a lot of buzz last year alongside fears it would revolutionize cybersecurity as we know it, this technology has instead played more of an evolutionary role to date. Much of its use by threat actors has focused on enabling operations to be more effective, rather than developing novel capabilities.
Regarding nation-state threats, Russia, China, North Korea and Iran-backed hackers are reportedly <a href="https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/" style="color: #467886;">leveraging generative AI to support campaigns</a> rather than using these tools to develop novel attack or abuse techniques. Google reported government-backed actors attempted to misuse Gemini for various malicious activities including researching vulnerabilities, developing malware (including ransomware and DDoS tools), crafting phishing campaigns, and conducting reconnaissance on target organizations.&nbsp;
Commenting on cybercrime threats, Alex Cox, LastPass' director of information security, pointed out to <a href="https://www.zdnet.com/article/how-ai-will-transform-cybersecurity-in-2025-and-supercharge-cybercrime/" style="color: #467886;">ZDNet</a> that, "the cybercrime adversary community is opportunistic and entrepreneurial, and they have been quick to adopt and deploy new technologies.&rdquo; The widespread availability of AI tools will lower the bar to enable less sophisticated actors&rsquo; attacks and others to increase their effectiveness. This technology boon has already allowed hackers to operate at scale with fewer resources, realizing productivity gains over novel techniques. Criminals exploit generative AI to commit fraud on a larger scale which increases the believability of their schemes. &nbsp;In December, the <a href="https://www.ic3.gov/PSA/2024/PSA241203" style="color: #467886;">FBI warned</a> that generative AI reduces the time and effort criminals must expend to deceive their targets.
We expect to see cyberattacks integrating AI with large language models (LLMs) and deepfakes, which will increase their potential severity, scale, and impact. I recently told <a href="https://www.techopedia.com/top-cybersecurity-threats-how-to-protect-your-data" style="color: #467886;">Techopedia</a> that &ldquo;AI, including [LLMs] and deepfake technologies, will become central in enabling more convincing social engineering, fraudulent schemes, and account takeover attacks, intensifying the need for advanced identity verification and fraud detection.&rdquo; Previously, cybercriminals have used AI-generated deepfake audio and video to trick employees into transferring funds or providing sensitive information. For instance, phishers targeted digital creators with a <a href="https://www.darkreading.com/remote-workforce/deepfake-videos-youtube-phish-creators" style="color: #467886;">deepfake video of YouTube CEO Neal Mohan</a> to try to install malware and steal credentials. We could plausibly see a scenario over the next several months that goes a step further, combining these elements together to conduct a more sophisticated attack. Take voice verification for instance, which is commonly used in the financial sector to verify customer identities. A threat actor could theoretically take voice samples of an individual&mdash;which are easily accessible thanks to social media&mdash;to create a deepfake, then phone into a call center and use an audio deepfake to operate in real time, powered by an LLM trained on stolen credentials and biographical/personal information to respond to challenge questions based on that stolen data in real time. Lag times in responses is still the biggest challenge to conduct these attacks, but that&rsquo;s getting shorter and shorter.
<h2 style="color: #000000; margin: 0in 0in 8pt;">Infostealers are continuing to rise in prominence and constantly evolving to counteract defenses.</h2>
In large part fueled by infostealers, leaked credentials are increasingly prevalent and represent entry points for attackers, enabling them to exfiltrate data, move laterally to sensitive systems, and much more. Over the last few years, infostealers have grown significantly with a <a href="https://www.infosecurity-magazine.com/news/browser-cyberthreats-surge-email/" style="color: #467886;">31% year-on-year increase</a> in infostealer incidents last year. Threat actors are particularly focused on infostealers because the stolen data can enable a wide range of other malicious activities. Take credentials, for instance. Credentials, particularly usernames and passwords, are among the most sought-after assets because they serve as the gateway to a person&rsquo;s or organization&rsquo;s sensitive data. Valid credential abuse has seen a <a href="https://www.infosecurity-magazine.com/news/browser-cyberthreats-surge-email/" style="color: #467886;">significant uptick</a>, with compromised credentials becoming the most common initial access vector last year ahead of phishing. To illustrate the scope of how prevalent and dangerous infostealers have become, 2.1 billion (75%) out of the 3.2 billion credentials stolen in 2024 <a href="https://www.forbes.com/sites/daveywinder/2025/03/18/password-warning-as-21-billion-credentials-hit-by-infostealer-attacks/" style="color: #467886;">were compromised by infostealer attacks</a>. Attackers leveraging AI, automation, and developing sophisticated tools will likely further scale these attacks.
Infostealers have been a key factor in some of the largest breaches recently. For instance, the attack targeting multi-cloud data warehousing platform Snowflake in May 2024 using exposed Snowflake credentials led to the exposure of data and impacted roughly 165 companies (though the <a href="https://cyberscoop.com/snowflake-hacker-judische-labscon-2024/" style="color: #467886;">number of companies extorted is far fewer</a>). Affected companies are continuing to come out several months after the initial attack. Starting in March this year, Hellcat ransomware gang breached multiple organizations using Jira credentials stolen from infostealer logs, leaking sensitive data. These incidents show that the risk of unmonitored credentials has never been greater.
While phishing remains the primary delivery mechanism for infostealers often disguised as legitimate attachments, we&rsquo;re also seeing a general shift to more browser-based cyberthreats, including infostealer malware. Hellcat-affiliated hackers introduced a stealthier alternative to server-side stealers, which eliminates massive exfiltration locally. This tactic is likely to catch on with other hackers to incorporate that into their wheelhouse. Doing so enables hackers to bypass traditional email filters and security controls and deliver malware directly on browsers.
Infostealers are quick to counteract defenses and adapt to remain effective. According to Spycloud&rsquo;s <a href="https://spycloud.com/resource/2024-malware-ransomware-defense-report/?utm_medium=pr%5B%E2%80%A6%5Dre-report-press-release-2024&amp;mkto_most_recent_source=Marketing" style="color: #467886;">2024 Malware and Ransomware Defense Report</a>, at least 54% of devices infected with infostealer malware had an antivirus or endpoint detection and response (EDR) solution installed&nbsp;at the time of infection. Many are frequently updated with new obfuscation capabilities to evade detection, and some hackers incorporate social engineering tactics to get around traditional security measures. Notably, the use of infostealers like AgentTesla, FormBook, and Strela Stealer has not only increased in frequency but also in the sophistication of the delivery methods. We expect this trend will continue as hackers hone their tactics to become more efficient and effective.
<h2 style="color: #000000; margin: 0in 0in 8pt;">Compromised identities in hybrid on-premises (on-prem) and cloud environments will pose significant threats.</h2>
Identity-based attacks are among the most effective ways hackers can gain initial access. Hybrid environments combine on-prem and cloud resources, creating a larger attack surface. In hybrid environments, a compromised identity on either the on-prem or cloud side can lead to significant security risks. Attackers can leverage compromised credentials to escalate their privileges, perform lateral movement, and potentially compromise the entire infrastructure. As companies continue to shift to hybrid IT environments, threat actors will follow the trend and take advantage of their security shortcomings.
Credential mismanagement was the top initial access vector for cloud environment attacks during the first half of 2024, a <a href="https://cloud.google.com/blog/topics/threat-intelligence/cybersecurity-forecast-2025/" style="color: #467886;">Google Cloud report</a> found. Compromising valid accounts has become the most common method for initial access to cloud environments, accounting for 35% of cloud incidents in the first half of 2024. A key access vector involves the use of infostealers. In 2024, threat actors updated Stealc and Vidar malware to <a href="IABs%20offload%20the%20difficult%20work%20of%20finding%20targets%20and%20gaining%20access," style="color: #467886;">specifically target</a> cloud account credentials. Accidental credential leakage remains another common method to gain unauthorized access to cloud environments. One scenario involves finding leaked cloud authentication tokens from publicly exposed code repositories like GitHub when hardcoded credentials are included in application code, then using automated tools to scan and get unauthorized access to cloud systems.
Two of the most prolific cybercriminal groups, BlackBasta and Scattered Spider, have targeted hybrid environments. Leaked internal chats from the BlackBasta ransomware group in February <a href="https://www.invictus-ir.com/news/cloud-heavy-hybrid-ready-lessons-from-blackbasta-and-scattered-spider" style="color: #467886;">revealed</a> the group operates as a Ransomware-as-a-Service (RaaS) with general, repeatable techniques for primarily targeting hybrid environments. Black Basta exploits hybrid access vectors and pivots laterally between cloud and on-prem using compromised credentials. Scattered Spider, on the other hand, primarily targets cloud environments but has also demonstrated an ability to pivot into hybrid infrastructure.
<h2 style="color: #000000; margin: 0in 0in 8pt;">Ransomware will continue the shift to prioritization of data exfiltration over data encryption.</h2>
Ransomware and extortionware aren&rsquo;t going anywhere anytime soon and will remain one of the most disruptive forms of cybercrime. New research found ransomware now plays a role in nearly <a href="https://therecord.media/ransomware-in-half-of-all-data-breaches-verizon" style="color: #467886;">half (44%) of all breaches</a>. Ransomware attacks continued to escalate so far this year, with a <a href="https://blog.checkpoint.com/research/q1-2025-global-cyber-attack-report-from-check-point-software-an-almost-50-surge-in-cyber-threats-worldwide-with-a-rise-of-126-in-ransomware-attacks/" style="color: #467886;">126% increase</a> in Q1 2025 compared to Q1 2024, totaling 2,289 reported incidents. North America accounted for most ransomware attacks (62%), followed by Europe (21%). This activity has been partially driven by infostealers, which steal data like session cookies and credentials, which hackers use to then launch attacks. Hackers also focus on theft of credentials and information that would be useful for performing further reconnaissance on compromised networks in many of these attacks. To stay protected, organizations need to focus on securing identities. That means knowing what information has already been stolen, quickly changing any compromised passwords, and ending any active sessions that may have been hijacked.
Additionally, the continued shift from data encryption to data exfiltration&mdash;allowing threat actors to smash and grab data, then hold it for ransom or sell it to other criminals without having to deploy malware to encrypt systems&mdash;remains highly effective. This has allowed hackers to increase the speed of attacks once they get their foot in the door. Attacks have become less about locking out access and more about paying to protect data from being publicly released.
Exploited vulnerabilities remained the most common root cause of ransomware attacks. According to <a href="https://www.scworld.com/resource/unpatched-vulnerabilities-the-powder-keg-fueling-ransomware-attacks" style="color: #467886;">Sophos</a>, nearly one-third of ransomware attacks start with unpatched vulnerabilities. Ransomware attacks caused by unpatched vulnerabilities also had <a href="https://www.msspalert.com/native/cyber-threat-trends-in-2024-the-landscape-according-to-top-industry-reports" style="color: #467886;">more severe consequences</a>, including higher ransom demands and longer recovery times. Additionally, social engineering, third-party access, and stolen cookies that enabled session hijacking ranked as some of the most common entry points for ransomware attacks.
The RansomHub attack on American Standard, a major manufacturer, shows that ransomware-as-a-service (RaaS) continues to be a trend in 2025 and makes it easy for cybercriminals to launch attacks. We may start to see more of a shift away from RaaS, which requires cybercriminals trust another criminal, to more AI-focused services to conduct target research, pull off more convincing social engineering, bypass security measures, write/modify code, and more. AI-powered ransomware using machine learning algorithms to automate and improve each stage of these attacks will pose a graver threat to organizations and individuals.&nbsp;
Ransomware and extortionware will remain pervasive threats throughout 2025 and beyond.
<h2 style="color: #000000; margin: 0in 0in 8pt;">Continued growth and privatization of zero-day market and increased speed of exploitation.</h2>
Adversaries are exploiting vulnerabilities to gain initial access to systems, trying to get in as quietly and efficiently as possible, while initial access brokers and automation makes hackers more efficient at doing so. Last year saw a 34% increase in attackers <a href="https://www.verizon.com/business/resources/reports/dbir/" style="color: #467886;">exploiting vulnerabilities</a> to gain initial access and cause security breaches. This trend is largely attributed to the widespread impact of zero-day vulnerabilities like the file transfer service MOVEit. Even though the MoveIT vulnerability was discovered in mid-2023, the fallout continued to play out last year when in November, <a href="https://www.infostealers.com/article/massive-moveit-vulnerability-breach-hacker-leaks-employee-data-from-amazon-mcdonalds-hsbc-hp-and-potentially-1000-other-companies/" style="color: #467886;">Nam3L3ss leaked 25 datasets</a> of companies, including Amazon, HSBC, Fidelity, US bank, McDonalds, and more. Notably, other file transfer services continue to be exploited for mass exfiltration, like Cleo and CrushFTP. According to <a href="https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2025/" style="color: #467886;">Mandiant</a>, the most frequently exploited vulnerabilities affected security devices, which are typically located at the edge of the network. Palo Alto&rsquo;s PAN-OS GlobalProtect (CVE-2024-3400), Ivanti&rsquo;s Connect Secure VPN (CVE-2023-46805) &amp; Policy Secure (CVE-2024-21887), and Fortinet&rsquo;s FortiClient EMS (CVE-2023-48788) were the leading exploits for initial access. Three of the four were first exploited as zero-days. Threat actors will continue to search for high impact vulnerabilities that could have widespread impacts.&nbsp;
Hackers are also quick to exploit zero-days once disclosed. Threat actors are targeting vulnerabilities quickly, as soon as they are publicly disclosed and oftentimes even before. In 2024, <a href="https://vulncheck.com/blog/2024-exploitation-trends" style="color: #467886;">23.6% of known exploited vulnerabilities</a> were exploited on or before the day their CVEs were publicly disclosed. According to Cloudflare, a newly disclosed vulnerability has come under attack <a href="https://www.scworld.com/news/vulnerabilities-exploited-faster-than-ever-says-cloudflare" style="color: #467886;">as fast as 22 minutes</a> after a proof of concept (POC) was disclosed. Scanning activity has largely contributed to this increase in attempts to automate exploits. Recently, the SAP NetWeaver zero-day (CVE-2025-31324) was widely exploited in April after a <a href="https://cyberscoop.com/sap-netweaver-zero-day-exploit-cve-2025-31324/" style="color: #467886;">suspected&nbsp;initial access broker</a> (IAB) likely deployed backdoors that were sold to ransomware groups.&nbsp;

2025 Cybersecurity Trends

We share cybersecurity insights and trends from the year so far and our predictions for the rest of the year ahead and beyond. 

2025 Cybersecurity Trends: Insights from the TIME Team

What is a Trojan Virus?

Understand the risks of trojan viruses and discover how LastPass's robust security measures safeguard your information. 

Understanding Trojan Viruses and How to Protect Your Devices

<h2>Tips to Check If a Link Is Safe </h2>
Checking to see if a link is secure might feel like an extra step or a hassle in an already busy day, but it&rsquo;s easy to make a few steps a quick habit that can prevent a future headache.&nbsp;
<h3>Verify the source of the link </h3>
Before clicking on a link, take a moment to verify its source. Ask yourself:&nbsp;
<ul>
 <li>Who sent the link? Is it from someone you know and trust?&nbsp;</li>
 <li>Is the sender's email address or social media profile legitimate? Look for subtle discrepancies, like slight misspellings in the domain name.&nbsp;</li>
 <li>Does the message context make sense? If you receive an unexpected link, especially one urging immediate action, be wary. </li>
</ul>
<h3>Check for HTTPS and secure connections </h3>
A secure website will use HTTPS (HyperText Transfer Protocol Secure) rather than HTTP. HTTPS encrypts the data exchanged between your browser and the website, making it significantly harder for cybercriminals to intercept and manipulate the information. Always look for a padlock icon in the address bar and ensure the URL begins with "https://" before entering any personal information.&nbsp;
<h3>Use URL scanning tools </h3>
Several online tools are available to help you check the safety of a link before you click on it. These tools can analyze a URL and provide a report on its safety. Some popular options include:&nbsp;
<ul>
 <li>Google Safe Browsing: Integrated into browsers like Chrome, this tool warns you about potentially dangerous sites.&nbsp;</li>
 <li><a href="https://safeweb.norton.com/" target="_blank" rel="noopener noreferrer">Norton Safe Web</a>: This tool provides safety ratings for websites based on user feedback and threat analysis.&nbsp;</li>
</ul>
Using these tools can reduce the risk of online threats and help protect users online.&nbsp;
To summarize, here&rsquo;s &ldquo;how to check if a link is safe&rdquo;:
First, you&rsquo;ll want to verify the source of the link, credibility of the sender, and rationale behind the email. If there aren&rsquo;t satisfactory answers to the three questions above, it&rsquo;s best to refrain from clicking on the link.
Second, make sure the URL begins with HTTPS, rather than the less secure HTTP.
Third, use link scanning tools like Google Safe Browsing and Norton Safe Web before clicking on links in unsolicited emails.
<h2>How to Check if a Link Is Safe on an iPhone </h2>
<h3>Preview link in Safari </h3>
On an iPhone, Safari allows you to preview a link before committing to a click. This feature is handy for checking the destination of a link without opening it. To use this feature, press and hold the link until a preview window appears. This preview can help you verify the URL and assess whether it looks legitimate.&nbsp;
<h3>Scan website tool in Safari </h3>
Safari also includes a built-in tool that checks the safety of websites you visit. This tool uses a database of known malicious websites to provide warnings when you attempt to visit a potentially dangerous site. To ensure this feature is enabled, go to Settings &gt; Safari &gt; Fraudulent Website Warning and make sure the toggle is turned on. This tool adds an extra layer of protection, alerting you to threats before they can cause harm.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/create-account.php?premium=1" target="_blank"><button class="lp-button lp-button--primary">Try Premium</button></a></div>
<h2>How to Check if a Link Is Safe on an Android </h2>
<h3>Update security settings </h3>
Keeping your Android device&rsquo;s security settings up to date is crucial for protecting against malicious links. Navigate to Settings &gt; Security and ensure that features like "Google Play Protect" and "Safe Browsing" are enabled. These settings help detect and prevent threats from affecting your device.&nbsp;
<h3>Enable Play Protect </h3>
Google Play Protect is a built-in security service that scans apps and links for potential threats. To enable it, open the Google Play Store, tap the menu icon, and select "Play Protect." Ensure it is turned on to benefit from real-time protection. Play Protect continuously scans your device for harmful behavior, helping to keep your data safe.&nbsp;&nbsp;
<h2>What to Do If You Click on a Malicious Link </h2>
<h3>Recognizing signs of a malicious link </h3>
After clicking a link, you might notice several red flags indicating that the link was malicious:&nbsp;
<ul>
 <li>Unexpected pop-ups: A sudden influx of pop-up ads or messages can signify malware infection.&nbsp;</li>
 <li>Slow device performance: Malware can run in the background, consuming resources and slowing down your device.&nbsp;</li>
 <li>Unauthorized changes: Be alert for changes to your device&rsquo;s settings or the appearance of unfamiliar apps, which could indicate malware activity. </li>
</ul>
<h3>Steps to take after clicking on a suspicious link </h3>
If you realize you&rsquo;ve clicked on a malicious link, take immediate action to mitigate potential damage:&nbsp;
<ul>
 <li>Disconnect from the Internet: This step can prevent malware from communicating with its command center or spreading further.&nbsp;</li>
 <li>Scan your device: Use reputable antivirus or anti-malware software to perform a thorough scan of your device and remove any detected threats.&nbsp;</li>
 <li>Change your passwords: Update passwords for sensitive accounts, prioritizing those linked to financial information or personal data.&nbsp;</li>
 <li>Monitor your accounts: Keep a close watch on your financial and online accounts for any signs of unauthorized activity. Report any suspicious transactions to your bank or service provider immediately. Some security tools like LastPass offer <a href="https://www.lastpass.com/features/dark-web-monitoring" target="_blank" rel="noopener noreferrer">dark web monitoring</a> to help users catch potential data breaches early and monitor any leaks of sensitive information.&nbsp;</li>
</ul>
<h3>Reporting and blocking malicious links </h3>
Reporting malicious links helps protect others from falling victim to similar threats. You can report suspicious links to your email provider or the website hosting the link. Additionally, use your browser's tools to block the site and prevent future access. Many browsers offer built-in features to report phishing sites and malicious content, contributing to a safer online environment for everyone.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/create-account.php?premium=1" target="_blank"><button class="lp-button lp-button--primary">Try Premium</button></a></div>
<h2>Stay Protected From Malicious Links </h2>
<h3>Importance of using a reliable link checker </h3>
Link checkers are tools that can detect and warn users about potential threats, significantly reducing the risk of clicking on dangerous links. By incorporating link checkers into your daily browsing habits, you can enhance your security and protect your personal information.&nbsp;
<h3>Benefits of LastPass in link safety </h3>
LastPass is widely known for its password management capabilities, but it also offers features that enhance link safety. By storing and autofilling passwords securely, LastPass helps you avoid phishing sites that try to steal your login credentials. Additionally, LastPass can generate complex, unique passwords for each of your accounts, further protecting against threats. Integrating LastPass into your online routine adds a layer of security against malicious links and phishing attempts.&nbsp;
<h3>Additional security measures for safe browsing </h3>
In addition to using link checkers and password managers, several other measures can help ensure safe browsing:&nbsp;
<ul>
 <li>Keep software updated: Regularly update your operating system, browsers, and security software to protect against the latest threats. Cybercriminals often exploit vulnerabilities in outdated software, so installing updates and patches is key. &nbsp;</li>
 <li>Use strong, unique passwords: Avoid reusing passwords across multiple accounts. Using a password manager like LastPass <a href="https://www.lastpass.com/features/password-generator" target="_blank" rel="noopener noreferrer">helps users create</a> and store strong, unique passwords for each account, which means that even if one account password is compromised, it can&rsquo;t be used across every account. LastPass not only stores and protects your passwords, but also lets admin users set a minimum requirement for length and complexity. &nbsp;</li>
 <li>Enable <a href="https://www.lastpass.com/features/password-generator" target="_blank" rel="noopener noreferrer">two-factor authentication (2FA)</a>: Add an extra layer of security to your accounts by enabling 2FA, which requires a second form of verification (such as a code sent to a user's phone) in addition to an account password.&nbsp;</li>
 <li>Prioritize <a href="https://www.lastpass.com/resources/webinars" target="_blank" rel="noopener noreferrer">learning and education</a>: Staying informed about the latest cybersecurity threats and best practices can reduce risk and improve user security. &nbsp;</li>
</ul>
Ensuring link safety is a critical component of maintaining against online-based threats, and adopting these practices will help you navigate the digital world with confidence and peace of mind. <a href="https://lastpass.com/create-account.php?premium" target="_blank" rel="noopener noreferrer">Start your free LastPass trial today</a>. &nbsp;
<h2 class="p1" style="color: #0f374e; margin-right: 0px; margin-bottom: 5.3px; margin-left: 0px;">FAQ</h2>
<h3 class="p3" style="color: #0f374e; margin: 0px 0px 5.3px;">What is the SLAM method?</h3>
The SLAM method is used to determine if a link is safe. The acronym represents a <a href="https://dailysecurityreview.com/blog/what-is-the-slam-method/">four-step framework</a> that involves double-checking the Sender, Link, Attachment, and Message.
<ul>
 <li class="p4" style="color: #000000; margin: 0px 0px 10.7px;">S = Stop before acting (Think before clicking on links or attachments</li>
 <li class="p4" style="color: #000000; margin: 0px 0px 10.7px;">L = Look closely for red flags (Examine the sending address for evidence of spoofing, and hover over links to see whether they direct to legitimate or questionable URLs)</li>
 <li class="p4" style="color: #000000; margin: 0px 0px 10.7px;">A = Ask a trusted source to confirm the authenticity of emails (Work with IT staff to validate emails before clicking on any links or attachments)</li>
 <li class="p4" style="color: #000000; margin: 0px 0px 10.7px;">M = Manage according to best practices (Follow corporate policies on handling phishing emails)</li>
</ul>
<h3 class="p3" style="color: #0f374e; margin: 0px 0px 5.3px;">How to check if a site is legit?</h3>
To <a href="https://www.consumersearch.com/technology/ultimate-guide-verify-website-legitimate">check if a site is legit</a>:
<ul>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Look for a secure connection between your browser and the website server (HTTPS instead of HTTP) by <a href="https://www.makeuseof.com/how-to-check-if-website-is-secure/">checking for a lock icon</a>.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Check to ensure there aren&rsquo;t <a href="https://www.makeuseof.com/how-to-check-if-website-is-secure/">any errors or slight discrepancies in the URL</a> or address.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Look for Trustpilot reviews, which can reveal how consumers view the site.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Check for key site elements, such as contact info, customer reviews, privacy and delivery policies, and certifications from reputable organizations.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Look for quality in site design and ease-of-use in navigation.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">To see whether an organization is well-established, investigate their social media accounts.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Determine if the content is well-written, informative, and error-free.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Use online tools like &ldquo;Whois Lookup&rdquo; to get info about domain registration details, including the owner&rsquo;s name, contact information, and registration date.</li>
</ul>
<h3 class="p3" style="color: #0f374e; margin: 0px 0px 5.3px;">Is there a way to check if a link is safe?</h3>
To check if a link is safe:
<ul>
 <li class="p2" style="color: #26262a; margin: 0px;">Use <a href="https://www.marketingscoop.com/tech/11-best-url-scanners-to-check-if-a-link-is-safe/">URL scanning tools</a> like Google Safe Browsing, Norton Safe Web, or VirusTotal.</li>
 <li class="p2" style="color: #26262a; margin: 0px;">For iPhone, enable the link preview and fraudulent website warning tool on Safari.</li>
 <li class="p2" style="color: #26262a; margin: 0px;">For Android, ensure that features like &ldquo;Google Play Protect" and "Safe Browsing" are enabled.</li>
 <li class="p2" style="color: #26262a; margin: 0px;">Check for secure HTTPS connections by looking for a padlock icon next to the address bar.</li>
</ul>

How to Check if a Link is Safe

Learn how to verify the safety of a link before clicking. Follow LastPass’s expert tips to protect yourself from phishing and malicious websites. 

Blog

Blog

Recent

Industry News

LastPass For Admins

LastPass Labs

Product Updates

Tips And Tricks