You might have seen <a href="https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024">this shocking prediction from Gartner:</a> by 2027, 75% of employees will acquire, modify or create technology outside IT&rsquo;s visibility &ndash; up from 41% in 2022.&nbsp;
Your employees rely on more SaaS tools than ever and not all of them are on your radar. &nbsp; 
From cloud apps and browser extensions to AI tools, today&rsquo;s workplaces move fast. And when anyone can implement a new app with little more than a credit card and a dream, you can be sure that very few of them are thinking about access or credential management. Consider this:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Shadow IT and Shadow AI are expanding the attack surface, with unsanctioned tools introducing security gaps no one&rsquo;s monitoring.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">App bloat is costing real money &mdash; small businesses now pay for an average of 134 unused applications, and large organizations pay for 473.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Sensitive data is slipping through the cracks, with 38% of employees admitting they&rsquo;ve shared work information with unauthorized AI tools.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Compliance is harder to maintain when there&rsquo;s no clear picture of who&rsquo;s accessing what, and from where.&nbsp;</li>
</ul>
Single sign-on (SSO) can help with your core apps-- the ones that you know about-- but it doesn&rsquo;t cover everything, especially those smaller, hidden apps. And for small and mid-sized businesses, controlling those can get expensive and time-consuming, fast.&nbsp;&nbsp;
That&rsquo;s where the security gaps start. Without a simple, customizable way to manage access, secure credentials and monitor app usage, it&rsquo;s easy to lose control. And that opens the door to risk from old accounts that still have access to sensitive info, to apps no one remembers signing up for.&nbsp;
It&rsquo;s no longer enough to secure passwords alone. Businesses need an approach to identity and access management that&rsquo;s as flexible, efficient, and user-friendly as the tools their employees actually use.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">What is Secure Access Experiences?&nbsp;&nbsp;</h2>
Secure Access Experiences is the LastPass answer to this growing access management crisis &mdash; an evolving approach designed to bring together essential capabilities into one intuitive experience. It helps you control who has access to what, based on your own policies &mdash; not just passwords. Whether your team is using approved tools or ones you didn&rsquo;t even know about, you&rsquo;ll get the visibility and control you need, all in one easy-to-use solution.&nbsp;
With Secure Access Experiences, you will be able to:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Log in with ease: Securely manage how your team stores and uses passwords. Support for passkeys makes logging in even faster and safer.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Control who gets access: Make sure the right people have access to the right apps, systems, and data&mdash;nothing more, nothing less. It&rsquo;s easy to set up and adjust as your business grows.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">See what&rsquo;s happening: Know which apps your team is using, when, and how. Stay informed, spot issues early, and feel confident that everything&rsquo;s running smoothly.&nbsp;&nbsp;&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Why do Secure Access Experiences matter?&nbsp;</h2>
As SaaS adoption grows and the lines between personal and professional tools blur, businesses need a smarter, simpler way to manage access &mdash; one that meets modern challenges head-on, without overwhelming teams or breaking the bank.&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Grows with your business: As your business adds more tools, people, and locations, LastPass makes it easy to keep everything secure without slowing you down.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Easy to manage, easier on your budget: Control access to all your tools from one place. Less hassle for you, and no need to invest in multiple systems.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Provides better protection, fewer headaches: Keep your business safe with strong, simple security&mdash;and make it easier to meet industry requirements along the way.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Simple for your team to use: When it&rsquo;s easy to use, your team actually uses it. That means stronger habits, less risk, and happier employees.&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">It starts with SaaS Monitoring.&nbsp;</h2>
You can&rsquo;t control what you can&rsquo;t see. That&rsquo;s why the first capability in Secure Access Experiences is SaaS Monitoring &mdash; expected in mid-May and delivered via the same browser extension already trusted by millions for password management.&nbsp;&nbsp;
<img src="https://cdn.lputil.com/-/media/2b6fd9bba92346a8a0fcedeca39eed06.png?h=824&amp;w=1250" >
<p class="Paragraph SCXW34306727 BCX0" paraid="543943140" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{232}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">With SaaS Monitoring, business owners and IT admins can finally see what apps are being used across their organization, helping them detect unapproved tools, spot Shadow IT and Shadow AI, and optimize application investments &mdash; all without the need to deploy extra agents, integrations or complexity.
<p class="Paragraph SCXW34306727 BCX0" paraid="713470910" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{238}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">Want to see the future of easier visibility and control? If you&rsquo;re attending RSA, stop by Booth 1449 in the South Expo at RSAC 2025 to see SaaS Monitoring in action. Get hands-on with live demos, hear from our experts, and see what&rsquo;s next for Secure Access Experiences with LastPass.
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>

Introducing Secure Access Experiences: Controlling the Chaos of Modern App Sprawl

Secure Access Experiences is the LastPass answer to this growing access management crisis.

Get LastPass Free

Create and store secure passwords for yourself, your team or business.

Why LastPass?

Remember fewer passwords and log in faster with our browser extension.

How LastPass works

LastPass zero-knowledge security model keeps your data private even from us.

Security Architecture

Compare LastPass competitors, plans, and features in one place

Compare LastPass

Overview

Password management

Save and autofill

Password generator

Password sharing

Dark web monitoring

Security dashboard

SaaS Monitoring

Key Features

Free LastPass Premium trial, no credit card required.

Free LastPass Business trial, no credit card required.

Let our experts help you find the right plan and successfully deploy LastPass.

Sync passwords across all devices, monitor password health, data breaches and much more.

Personal

Premium password management for family or group of 6 people.

Families

Personal Plans

30-day free LastPass Premium trial, no credit card required.

30-day free LastPass Families trial, no credit card required.

Limited to 1 device type and basic password management features

Designed for businesses of all sizes, from small startups to enterprises.

Business

Gain complete visibility into your organization’s entire SaaS footprint.

Business Max

For single teams just getting started with password management.

Teams

Designed to keep your clients' credentials protected and private

Business Plans

User management

Business sharing

Multifactor authentication

Integrations

Single sign-on

Identity management

For admins

Case Studies

Webinars

Product demos

Solutions by roles

Blog

Trust Center

Compliance Center

LastPass University

Resources & Solutions

Pricing

Join the LastPass Partner Program to provide even more value to your customers.

Partner program overview

Managed Service Providers

Resellers

Cloud marketplaces

Technology Alliance Partners

LastPass Partner Program

Grow new revenue streams by meeting customer's security needs.

Looking for help or interested in becoming a LastPass partner? Get in touch with our partner team.

Connect with trusted LastPass Partners to support your security needs.

Partners

Self-service library of resources and guides for all LastPass products.

Support Center

Community forum

System status

Help

Personal support for all LastPass’ subscribed customers.

Support

Get LastPass free

Chat with sales

Call sales

Email sales

Request a demo

Find a partner

Contact sales

Log in

How to defend yourself against computer viruses 

Everything you need to know about computer viruses to stay safe.

The Enemy You Can’t See: How to Defend Yourself Against Computer Viruses 

How to reset my comcast email password

Learn how to reset your Comcast email password and boost your online security now.

Reset Your Comcast Email Password and Boost Your Online Security Now

Weak credentials recently gave researchers access to years&rsquo; worth of McDonald&rsquo;s applicants&rsquo; data. While McDonald&rsquo;s McHire AI chatbox lightened the administrative load for the multinational corporation&rsquo;s HR department, it also presented an opening for hackers to access job applicants&rsquo; information going back years. This incident demonstrates how the &ldquo;intelligence&rdquo; in AI isn&rsquo;t a given when it comes to basic cybersecurity measures, like passwords. This breach raises questions about data privacy and transparency for job applicants and the security of AI-enabled tools. We&rsquo;ll take a closer look at how this simple brute force attack happened and what you can do to protect yourself to avoid falling victim to a similar hack.
What happened?
Researchers discovered a <a href="https://www.wired.com/story/mcdonalds-ai-hiring-chat-bot-paradoxai/">vulnerability in McHire</a>, McDonald&rsquo;s chatbot job application platform built by AI software firm Paradox.ai. The AI chatbot screens applicants, collects their contact information and resumes, and engages in basic interactions that an HR department would typically handle. The breach was enabled by weak credentials of a Paradox.ai administrative account that used an appallingly weak username and password (&ldquo;123456&rdquo;).&nbsp;This is one of the most common passwords out there that makes it practically effortless for threat actors to crack. Once the researchers gained access to the admin account, they were able to access every application to McDonald&rsquo;s over the past few years. The researchers were also able to complete and manipulate a test application on the backend and access other applicants' chat logs and contact information by changing the applicant ID number for their application. This was due to an insecure direct object reference (IDOR) on an internal API. Luckily, the account was not accessed by any third party other than the researchers. 
If someone had the opportunity to exploit the data, it could have made years&rsquo; worth of McDonalds applicants the targets of phishing attacks and scams. For instance, attackers could hypothetically have used this list of individuals to conduct a type of payroll scam or use applicants&rsquo; sensitive information to conduct other attacks.&nbsp; 
Root causes: How did it happen? 
The root cause of this breach was poor identity access management of a third-party vendor's administrator account. Enforcing strong password guidelines and MFA could have protected the admin account from the start.&nbsp;Good password hygiene is typically the first line of defense against attackers. People who use weak or reused passwords increase their risk of data breaches, extortion, and more. In fact, over half of all reported data breaches resulted from weak passwords. Hackers can easily get access to exposed credentials from previous breaches and infostealer logs sold on the dark web. Using weak passwords can make you an easy target for hackers looking for a way into your accounts, either to target you directly or gain access to other sensitive systems you may have access to. 
Additionally, the breached admin account appeared to be inactive, with its last login reportedly in 2019. Inactive accounts are prime targets for cyberattacks because they can provide attackers with a foothold in the network to move laterally and access critical systems.&nbsp;Admin accounts are especially enticing for hackers since oftentimes they have elevated access permissions, allowing attackers to infiltrate deeper into systems with less effort. 
A warning: Don&rsquo;t be blinded by AI 
As AI-powered bots get implemented to help streamline the hiring process or for other purposes, this new technology also introduces vulnerabilities&mdash;in this case, web-based vulnerabilities involving a simple administrator account's username and password (&ldquo;123456&rdquo;) that served as the keys to a data breach.&nbsp; While AI can help boost productivity and security defenses, unwavering excitement can simultaneously blind people to potential risks. This breach carries a warning for folks: don&rsquo;t let your AI-enthusiasm distract you from basic cybersecurity best practices.&nbsp; Sometimes the promise of AI isn&rsquo;t all it&rsquo;s cracked up to be when these tools open businesses up to new vulnerabilities.
As AI usage has picked up, there have been several reports of AI data leaks due to misconfigurations, training data exposure, model extraction, in-memory leaks, adversarial attacks, and more. That should be a reminder for companies to closely evaluate their tool suite.&nbsp;Just like any new technology, security professionals should rigorously evaluate third-party AI apps and tools.&nbsp; 
What can you do? 
<ul style="margin-top: 0in; list-style-type: disc;">
 <li>Use strong, unique passwords. Think of this as a single bolt lock to secure your door. See more password hygiene tips in our blog post <a href="http://blog.lastpass.com/posts/elevate-password-hygiene">&ldquo;How to Elevate Your Password Hygiene: Tips and Tricks for Protecting Your Credentials.&rdquo;</a> </li>
 <li>Another simple but crucial step to securing your online accounts is implementing multi-factor authentication (MFA). This is like adding a padlock on top of your locked door (with strong passwords). There are many forms of MFA available, including SMS text, hardware tokens, push notifications, and biometrics. Two-factor authentication (2FA) is a common form of MFA that combines your password with either a generated code or biometric verification. Learn more about the <a href="https://blog.lastpass.com/posts/sms-is-insecure">pros and cons of common 2FA methods</a>. </li>
 <li>Password managers can help protect accounts by generating strong, unique passwords for each account and storing them securely in an encrypted vault. This helps prevent the use of weak, easily guessed passwords.&nbsp;</li>
 <li>As far as third-party vendors are concerned, your security is only as strong as the sum of your parts. Businesses should evaluate their third party's security standards, including their password hygiene.&nbsp;</li>
</ul>

McHack’d: How Weak AI Credentials Served Up a Data Breach

Weak credentials recently gave researchers access to years’ worth of McDonald’s applicants’ data. We’ll take a closer look at how this simple brute force attack happened and what you can do to protect yourself to avoid falling victim to a similar hack.

Dropbox <a href="https://help.dropbox.com/en-us/installs/dropbox-passwords-discontinuation#extension">has officially</a> <a href="https://help.dropbox.com/en-us/installs/dropbox-passwords-discontinuation#extension">announced</a> the discontinuation of its password management tool, Dropbox Passwords, as the company shifts its focus to other features, with full shutdown in October 2025.&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;
If you&rsquo;ve been using Dropbox Passwords, your credentials are going to need a new home. The good news? You&rsquo;ve come to the right place to make that move.&nbsp; &nbsp;
<h2 class="p2" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">What will happen to Dropbox Passwords?&nbsp;&nbsp;</h2>
The shutdown will happen in three phases, so mark your calendars:&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">August 28, 2025: Your saved data becomes view-only. Autofill stops working.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">September 11, 2025: The mobile app stops working. Access is limited to the browser extension.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">October 28, 2025: Dropbox Passwords will be fully discontinued. All stored credentials and payment data will be permanently deleted from Dropbox servers.&nbsp;&nbsp;</li>
</ul>
As for all that data, Dropbox recommends exporting your saved credentials before the shutdown to avoid losing access.&nbsp;&nbsp;
<div class="button-container"><a href="https://www.lastpass.com/trial/business"><button class="lp-button lp-button--primary">Try Business</button></a><a href="https://lastpass.com/create-account.php?premium=1"><button class="class lp-button--red-outline">Try Personal</button></a></div>
<h2 class="p2" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">How do I export my data from Dropbox Passwords?&nbsp;&nbsp;&nbsp;</h2>
You can export all of your account logins and payment cards from Dropbox Passwords as a CSV file in only a few steps.&nbsp;&nbsp;
<h3 class="p3" style="color: #121010; margin: 0px;">If you're on your browser using Dropbox Passwords:&nbsp;&nbsp;</h3>
<ol>
 <li class="li3" style="color: #121010; margin: 0px;">Open the Dropbox Passwords browser extension.&nbsp;&nbsp;</li>
 <li class="li3" style="color: #121010; margin: 0px;">Click your avatar (profile picture or initials) in the bottom-left corner.&nbsp;&nbsp;</li>
 <li class="li3" style="color: #121010; margin: 0px;">Click Preferences.&nbsp;&nbsp;</li>
 <li class="li3" style="color: #121010; margin: 0px;">Click the Account tab.&nbsp;&nbsp;</li>
 <li class="li3" style="color: #121010; margin: 0px;">Click Export.&nbsp;&nbsp;&nbsp;&nbsp;</li>
</ol>
<h3 class="p3" style="color: #121010; margin: 0px;">If you&rsquo;re using the Dropbox Passwords mobile app:&nbsp;&nbsp;</h3>
<ol>
 <li class="li3" style="color: #121010; margin: 0px;">Open the Dropbox Passwords mobile app.&nbsp;&nbsp;</li>
 <li class="li3" style="color: #121010; margin: 0px;">Tap settings.&nbsp;&nbsp;</li>
 <li class="li3" style="color: #121010; margin: 0px;">Tap Export.&nbsp;&nbsp;</li>
</ol>
Your data's packed and ready. Now it&rsquo;s time to get a new password manager.&nbsp; &nbsp;
<h2 class="p2" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">What to look for in a new password manager&nbsp;&nbsp;</h2>
No matter what your passwords are used for &ndash; to protect your personal life or safeguard your professional one &ndash; you need a tool that prioritizes <a href="https://blog.lastpass.com/posts/how-to-choose-and-use-a-password-manager">security, usability and flexibility</a>.&nbsp;&nbsp;
&nbsp;&nbsp;
A <a href="https://www.lastpass.com/products/premium-password-manager">personal password manager</a> should include:&nbsp;&nbsp;
<ul>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">End-to-end encryption to keep your data private&nbsp;&nbsp;</li>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Cross-device access (mobile, desktop, and browser)&nbsp;&nbsp;</li>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Passwordless login options and support for passkeys&nbsp;&nbsp;</li>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Secure sharing for family or trusted contacts&nbsp;&nbsp;</li>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Multi-factor authentication (MFA) for extra security&nbsp;&nbsp;</li>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Dark web monitoring to alert you of exposed credentials&nbsp;&nbsp;</li>
</ul>
If you're <a href="https://www.lastpass.com/products/business">securing a team or organization</a>, prioritize:&nbsp;&nbsp;
<ul>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Admin controls for centralized management&nbsp;&nbsp;</li>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Shared folders for streamlined collaboration&nbsp;&nbsp;</li>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Customizable policies to enforce best practices&nbsp;&nbsp;</li>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">SaaS monitoring to track app usage and risk&nbsp;&nbsp;</li>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Advanced authentication like MFA and single sign on (SSO)&nbsp;&nbsp;</li>
</ul>
<h3 class="p2" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Ready to make the move today? Try LastPass&nbsp;</h3>
A password manager that checks all the boxes? LastPass offers a powerful, secure, and user-friendly tool that <a href="https://support.lastpass.com/s/document-item?language=en_US&amp;bundleId=lastpass&amp;topicId=LastPass/import-generic-csv.html&amp;_LANG=enus">makes switching simple</a> (all you need is that CSV file).&nbsp;
<iframe width="560" height="315" src="https://www.youtube.com/embed/BuT_OPfuyPU?si=ttNKGrUWVCErV3Ib" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe>
Dropbox Passwords may be coming to an end, but your password security doesn&rsquo;t have to. <a rel="noopener noreferrer" href="https://www.lastpass.com/pricing" target="_blank">Try LastPass today</a> to keep your digital life protected (and get 30% off).&nbsp;
<div class="button-container"><a href="https://www.lastpass.com/trial/business"><button class="lp-button lp-button--primary">Try Business</button></a><a href="https://lastpass.com/create-account.php?premium=1"><button class="class lp-button--red-outline">Try Personal</button></a></div>

It’s Time for a New Password Manager: Dropbox Passwords Is Shutting Down 

If you’ve been using Dropbox Passwords, your credentials are going to need a new home.

It’s Time for a New Password Manager: Dropbox Passwords Is Shutting Down

The May 21 announcement of a law enforcement operation in conjunction with Microsoft targeting LummaC2 that resulted in the seizure of over 2,300 malicious domains was rightly celebrated as a major victory against the ongoing scourge of infostealers, a family of malware that has risen to prominence over the last few years for both its ubiquity and its central role in numerous major breaches. This disruption of the infostealer ecosystem led to the rise of a new infostealer,&nbsp;Acreed.1&nbsp;While the rumors of LummaC2&rsquo;s demise turned out to be a bit exaggerated (as highlighted in&nbsp;<a class="Hyperlink SCXW193238760 BCX0" href="https://www.trendmicro.com/en_us/research/25/g/lumma-stealer-returns.html" target="_blank" rel="noopener noreferrer" style="color: inherit; margin: 0px; padding: 0px;">this recent excellent report from TrendMicro),</a>Acreed&nbsp;has&nbsp;maintained&nbsp;a foothold within the infostealer market while&nbsp;remainingrelatively elusive&nbsp;for defenders.&nbsp;Let&rsquo;s&nbsp;take a closer look at what we know about&nbsp;Acreed.&nbsp;
Acreed&nbsp;began offering credentials for sale in the dark web marketplace, Russian Market, in mid-February of this year. Since its introduction, only one account on Russian Market has offered stolen credentials associated with&nbsp;Acreed&nbsp;for sale. The account, which is anonymized to some degree as all accounts are on Russian Market,&nbsp;leverages&nbsp;the username &ldquo;Nu####ez.&rdquo; This threat actor has been posting logs on Russian Market since at least early 2024 and had previously been associated&nbsp;largely with&nbsp;the sale logs associated with LummaC2. However, earlier this year, Nu####ez began offering logs stolen via the new&nbsp;Acreed&nbsp;stealer. While postings were initially erratic, Nu####ez began posting more&nbsp;Acreed&nbsp;logs regularly beginning in early May. A few weeks later, law enforcement conducted the LummaC2 takedown operation, leading to a sharp increase in&nbsp;Acreed&rsquo;s&nbsp;percentage share in logs posted on Russian Market. Some of this reflected the quick drop in available logs due to the LummaC2 disruption, but there was&nbsp;a commensurate&nbsp;increase in available&nbsp;Acreed&nbsp;logs as well.&nbsp;
Interestingly,&nbsp;Acreed&nbsp;does not seem to be available for sale like LummaC2 or other infostealers-as-a-service, nor were we, in conjunction with our friends at Flashpoint, able to find any samples in the wild. As such,&nbsp;it appears the malware&nbsp;is used in a limited fashion, though indications from the log files provide enough data to support the hypothesis that&nbsp;Acreed&nbsp;is indeed its own infostealer and not a simple renaming of logs stolen with another malware. As Flashpoint found,&nbsp;Acreed&nbsp;uses a unique directory and file naming convention that could be used to potentially&nbsp;identify&nbsp;samples in the wild or during runtime (see below).&nbsp;
<img src="https://www.lastpass.com/-/media/6ab586f36c38433499f239eff3823d8e.png?h=211&amp;w=621" >
Acreed stealer log files (Source: Flashpoint)
<p class="Paragraph SCXW12872475 BCX0" paraid="609014671" paraeid="{50f73fad-9d5e-4573-89ae-0e37c35b3dcb}{153}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 24px; padding: 0px;">Its relatively limited usage is further evidenced by the total available logs on Russian Market, which total over 19,000 infections in 2025 as of late July, compared to over 175,000 infections for LummaC2, according to Flashpoint analysis.&nbsp;
<p class="Paragraph SCXW12872475 BCX0" paraid="844947943" paraeid="{50f73fad-9d5e-4573-89ae-0e37c35b3dcb}{165}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 24px; padding: 0px;">While samples are not available to analyze, Flashpoint was able to develop a YARA rule that could help detect if the malware is compiling logs on victim systems based on the available data. LastPass will continue to monitor activity associated with both Acreed and LummaC2 and post updates as new information becomes available and take all practicable actions to help protect our customers and disrupt these infostealer operations.&nbsp;
&nbsp;

Lumma persists and Acreed Rises

While the rumors of LummaC2’s demise turned out to be a bit exaggerated, Acreed has maintained a foothold within the infostealer market while remaining relatively elusive for defenders. Let's learn more about Acreed malware.

Lumma Persists and Acreed Rises Following Law Enforcement Actions

How to reset your iCloud password if you forgot it

We provide quick answers on how to reset your iCloud password, even if you don’t have access to an email, phone number, or trusted device.  

Forgot Your iCloud Password? Here’s How to Reset It 

The LastPass TIME Team is thrilled to announce the launch of our new podcast The Phish Bowl! Join us every month as my longtime colleague and co-host Mike Kosak and I (Stephanie Schneider) dive into the global cyber threat landscape. Every episode, we&rsquo;ll unpack what&rsquo;s really going on beneath the surface, exploring the globe region by region. We&rsquo;re also publishing a <a href="https://info.lastpass.com/threat-reports">new report</a> for each region on a quarterly basis that will serve as the foundation for the podcast.&nbsp;&nbsp;
When we&rsquo;re looking at what&rsquo;s shaping regional cyber activity, it&rsquo;s helpful to understand the geopolitical environment and factors influencing various actors&rsquo; motivations.&nbsp; Integrating these geopolitical insights with a strategic high-level view of potential threats informs organizations&rsquo; proactive cybersecurity decision-making. It helps security teams better anticipate, identify and respond to threats, and it helps businesses proactively address potential outcomes and contextualize threats specific to their industry, region, or business operations.&nbsp;&nbsp;
For our first episode, we kicked things off with a deep dive into the Asia-Pacific (APAC) region. APAC is one of the most active, complex cyber environments given its dynamic geopolitical environment, economic factors, and flourishing cybercrime scene. We were lucky to be joined by Nate Blumenthal, former senior intelligence advisor to CISA, as our inaugural episode&rsquo;s special guest. Nate shared sharp insights on Iran&rsquo;s cyber posture and its shift towards hybrid warfare in the context of the ongoing conflict in the Middle East. Nate also offered some practical suggestions to improve your own cybersecurity that everyone can implement right now.&nbsp;&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Why APAC matters right now&nbsp;</h2>
APAC cyberattacks trended high last year due to a high number of financially motivated cybercrime and state-backed attacks. This trend has continued this year. APAC experienced the largest share of incidents globally (34%) in 2024, which marks a 13% increase, <a href="https://www.ibm.com/thought-leadership/institute-business-value/report/2025-threat-intelligence-index">according to IBM</a>. From ransomware to credential theft, the region is experiencing a broad range of threats. Industries like manufacturing, finance, and transportation are especially targeted.&nbsp;&nbsp;
Ransomware remains one of the most pervasive threats to the region. Last year, Asia accounted for approximately 11% of global ransomware activity mainly targeting manufacturing and engineering, with India and Japan seeing significant activity. Australia emerged as a top regional ransomware target, and it is among the top 10 of countries impacted based on ransomware gang reporting of alleged victims. There were several victims in Taiwan, Singapore, and Japan. Thailand also saw an unusual increase in victims.&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Nation-state threats: China, North Korea, and Iran&nbsp;</h2>
Beijing-backed hackers have been particularly aggressive and appear to have targeted intellectual property theft, telecom intrusions, and semiconductors. What&rsquo;s interesting is how closely their cyber activity aligns with Beijing&rsquo;s strategic Five-Year Plans that outline goals, objectives, and policy directions. It&rsquo;s like they're handing us a roadmap that aligns with their long-term ambitions.&nbsp;
Then there&rsquo;s North Korea. They&rsquo;ve continued to go after crypto and are infiltrating the workforce in the US and, more recently, expanded to targeting European private entities for malicious purposes, including data exfiltration and extortion and the enablement of cryptocurrency thefts. The scheme involves thousands of DPRK IT workers who use false or stolen identities from people in the US and other countries to obscure their true nationality and get hired at private companies across almost every sector. These North Korean IT workers may seek direct employment with targeted companies or attempt to gain access via third-party vendors and/or contractors. This is all part of an effort to bypass sanctions to raise funds for Pyongyang&rsquo;s regime and weapons programs. The US Department of Justice recently <a href="https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote">announced several actions</a> to combat this scheme.&nbsp;
Nate brought some fantastic perspective on Iran, especially in the context of the recent Israel-Iran conflict. A big takeaway from our conversation is that cyber operations are no longer just a side tactic&mdash;they&rsquo;re central to modern conflict. And the private sector is squarely caught in the crosshairs.&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Cybercrime in Australia&nbsp;</h2>
The rise of cybercrime in APAC has been particularly pervasive in Australia, which has recently emerged as a popular target, especially when it comes to ransomware. For example, Australian airline Qantas was recently breached by Scattered Spider using social engineering tactics in early July 2025, exposing customer data belonging to up to 6 million customers. &nbsp;
The latest in a string of significant attacks targeting Australia-based entities, we explore a recent attack targeting a campaign targeting the country&rsquo;s Association of Superannuation Funds in depth. In March, a credential stuffing campaign targeted multiple large Australian superannuation funds, compromising over 20,000 member accounts. This type of attack takes advantage of individuals who reuse the same password across accounts. Additionally, the attack highlighted a vulnerability within some superannuation funds where MFA was either not offered or not automatically enabled on some accounts. The attackers aimed to commit fraud, attempting fund transfers, with mixed results. &nbsp;
For more on cyber threat environment facing the public and private sectors in Australia, we highly recommend reading the Australian Signals Directorate&rsquo;s Australian Cyber Security Center&rsquo;s (ACSC) latest <a href="https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2023-2024">Annual Cyber Threat Report</a>.&nbsp;The data includes trends and information on threat actor tactics and techniques as well as recommended actionable steps organizations and individuals can take to help mitigate these threats. Our LastPass Labs blog article summarizes the <a href="https://blog.lastpass.com/posts/acsc-2024-report-implications">key takeaways</a>.&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Critical basics to get correct&nbsp;</h2>
Nate also shared four things every organization should be doing right now:&nbsp;
<ol>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Patch and update systems immediately.&nbsp;&nbsp;</li>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Use strong, unique passwords.&nbsp;&nbsp;</li>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Implement multi-factor authentication (MFA).&nbsp;&nbsp;</li>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Train employees on AI-driven phishing and social engineering.&nbsp;</li>
</ol>
As Nate said, &ldquo;The threat is only going to increase&mdash;and AI will make it worse. Awareness and training are key.&rdquo; Getting the basics right will lower your risk exposure, putting you and your organization in a better position to focus on the important stuff knowing you&rsquo;re several steps ahead of the bad guys. &nbsp;
Interested in reading more about improving your cybersecurity posture? We recently shared guidance on&nbsp;<a href="https://blog.lastpass.com/posts/elevate-password-hygiene">password hygiene</a> and how to stay compliant with <a href="https://blog.lastpass.com/posts/stay-compliant-with-new-password-regulations">password regulations</a>. As the recent Entra account takeover campaign demonstrated, <a href="https://blog.lastpass.com/posts/entra-account-takeover-campaign">password hygiene is still the first step</a> to keep your accounts secure. We also explore various <a href="https://blog.lastpass.com/posts/sms-is-insecure">2-factor authentication (2FA) methods</a> and weigh the pros and cons of each.&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Listen to the full episode&nbsp;&nbsp;</h2>
If you&rsquo;ve made it this far, by now you&rsquo;ll have realized that no, we&rsquo;re not a podcast about the 90s jam band Phish&mdash;but we do go deep. If you haven&rsquo;t tuned in yet, we hope you&rsquo;ll give our inaugural episode a listen. We had a blast recording it, and we&rsquo;re just getting started. If you like what you&rsquo;ve heard so far, stay connected with us.&nbsp;&nbsp;
<ul>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Listen to Episode 1 of The Phish Bowl wherever you get your podcasts: &nbsp;<a href="https://www.youtube.com/@LastPass/podcasts"></a></li>
</ul>
<a href="https://www.youtube.com/@LastPass/podcasts">		YouTube</a>
<a href="https://open.spotify.com/show/1TQiFDk9acmkfp1sTFN1yX">		Spotify</a>
<a href="https://podcasts.apple.com/podcast/id1828511920">		Apple</a>
<ul>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Subscribe for monthly threat intel deep dives.&nbsp;</li>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Access LastPass' <a href="https://info.lastpass.com/threat-reports">Regional Report</a> for detailed analysis of recent APAC trends and activity.&nbsp;</li>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Check out the <a href="https://blog.lastpass.com/categories/lastpass-labs">LastPass Labs blog</a> for more insights.&nbsp;</li>
</ul>
Thanks to all our inaugural listeners for taking the plunge with us on the first episode of The Phish Bowl. We'll be back with more threat environment updates in next month&rsquo;s episode talking about North America, along with a corresponding regional report!

Cyber Threats in APAC

What We Covered in the First Episode of The Phish Bowl

Cyber Threats in APAC: What We Covered in the First Episode of The Phish Bowl

The convergence of increasing threat complexity, desktop and mobile diversification, a decentralized workforce, and exponential SaaS expansion has created a critical inflection point for organizations: traditional access management tools are falling short.&nbsp;
They need a robust, scalable solution to secure digital identities, streamline authentication, and maintain viability across an ever-expanding attack surface, all without compromising the user experience.&nbsp;
Enter LastPass Business Max.&nbsp;
LastPass Business Max helps organizations reimagine how they secure access, manage credentials, and gain critical insights into application usage &ndash; without extra agents or user disruption.
And now LastPass Business Max is available on Amazon Web Services (AWS) Marketplace, delivering powerful credential and access management and SaaS monitoring to your AWS-native workflows with just a few clicks.&nbsp;
<h2 class="paragraph" style="color: #000000; margin: 0in;">What Is LastPass Business Max?</h2>

<a rel="noopener noreferrer" href="https://aws.amazon.com/marketplace/pp/prodview-kb2pfb4g3m6pc" target="_blank">LastPass Business Max</a>&nbsp;doesn&rsquo;t just provide best-in-class <a rel="noopener noreferrer" href="https://www.lastpass.com/password-manager" target="_blank" style="color: inherit;">password and access management.</a> It unlocks instant visibility into your entire SaaS footprint &ndash; all through the LastPass Browser extension
&nbsp;
And when over half of technology spend happens outside of IT&rsquo;s control, visibility into your SaaS footprint is no longer optional. It&rsquo;s essential.
&nbsp;
SaaS Monitoring empowers your organization to:
<ul>
 <li class="paragraph" paraid="105884194" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{60}" style="color: #000000; margin: 0in;">Discover Shadow IT and rogue AI tools: Identify every SaaS app in your business environment, whether approved or not.</li>
 <li class="paragraph" paraid="105884194" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{60}" style="color: #000000; margin: 0in;">Monitor app usage and user activity: Detect risky behaviors and enforce policies.</li>
 <li class="paragraph" paraid="105884194" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{60}" style="color: #000000; margin: 0in;">Cut costs and optimize app value: Spot duplicate, unused, or over-provisioned apps to reduce waste.</li>
 <li class="paragraph" paraid="105884194" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{60}" style="color: #000000; margin: 0in;">Stay compliant and secure: Meet regulatory requirements and protect sensitive data with unified visibility.</li>
 <li class="paragraph" paraid="105884194" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{60}" style="color: #000000; margin: 0in;">Prepare for disruptions: Inventory your SaaS apps for continuity planning and to prevent data loss.</li>
</ul>
A browser-based approach means that deployment is frictionless. Users simply carry on with their workflows, while your organization gets a clear lens into what tools are being used and how.
<h2 class="paragraph" paraid="2132862629" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{161}" style="color: #000000; margin: 0in;">Why LastPass Business Max on AWS Marketplace?</h2>

As organizations increasingly adopt hybrid work models and cloud-native tools, procurement needs to be just as agile as the technology it supports.&nbsp;
&nbsp;
By offering LastPass Business Max as part of the <a rel="noopener noreferrer" href="https://aws.amazon.com/partners/" target="_blank" style="color: inherit;">AWS Partner Network</a> (in addition to LastPass Business, which <a rel="noopener noreferrer" href="https://www.lastpass.com/company/newsroom/0d029e50-10e1-4ef3-a668-12a9bb4d70a8" target="_blank" style="color: inherit;">debuted last summer</a> on AWS Marketplace), we&rsquo;re meeting you where you work, empowering seamless procurement and faster time-to-value.&nbsp;
Benefits include:
<ul>
 <li class="paragraph" paraid="1346990980" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{227}" style="color: #000000; margin: 0in;">Simplified purchasing workflows using your existing AWS account</li>
 <li class="paragraph" paraid="1346990980" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{227}" style="color: #000000; margin: 0in;">Flexible billing structures and contract management within AWS</li>
 <li class="paragraph" paraid="1346990980" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{227}" style="color: #000000; margin: 0in;">Rapid deployment with zero additional software or complex installations</li>
 <li class="paragraph" paraid="1346990980" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{227}" style="color: #000000; margin: 0in;">Transaction convenience with Public Offer, Private Offer, and Channel Partner Private Offer purchasing paths (and free trials!)</li>
</ul>
As an <a rel="noopener noreferrer" href="https://aws.amazon.com/partners/programs/isv-accelerate/" target="_blank" style="color: inherit;">AWS ISV Accelerate Partner</a>, LastPass is increasingly co-sold alongside other leading solutions in the AWS ecosphere. And since LastPass is also deployed on AWS, it unlocks tremendous benefits and rewards for AWS buyers. LastPass is also featured in AWS internal tools and CRM integrations, increasing visibility and Marketplace traction.&nbsp;
<h3 class="paragraph" style="color: #000000; margin: 0in;">Ready to Learn More?</h3>

Securing your business and stopping SaaS sprawl has never been easier. Compare features, read G2 reviews, and try LastPass Business Max free for 14 days on <a rel="noopener noreferrer" href="https://aws.amazon.com/marketplace/pp/prodview-kb2pfb4g3m6pc" target="_blank">AWS Marketplace today</a>.

LastPass Business Max Now Available on AWS Marketplace 

LastPass Business Max is available on Amazon Web Services (AWS) Marketplace, delivering powerful credential and access management and SaaS monitoring. 

Lost your Snapchat My Eyes-Only passcode? How to fix it fast

Learn how you can reset your My Eyes Only passcode.

Lost Your Snapchat My Eyes-Only Passcode? How to Fix It Fast 

Summer is here and that can only mean one thing in the cybersecurity world &ndash; <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/" target="_blank" style="color: inherit;">Black Hat 2025</a>!
&nbsp;
For six days at the <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/travel.html" target="_blank" style="color: inherit;">Mandalay Bay Convention Center</a> in Las Vegas (August 2-7), the cyber world will come together for events, trainings, briefings, and networking &ndash; affectionately referred to as &ldquo;hacker summer camp.&rdquo;&nbsp;
&nbsp;
Best of all, LastPass will be there &ndash; <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/registration.html" target="_blank" style="color: inherit;">will you</a>?&nbsp;Read on for your LastPass itinerary at Black Hat 2025.&nbsp;
<h2 class="paragraph" paraid="1521409206" paraeid="{8cfdb4d7-d017-452d-add9-b8313e3325fc}{115}" style="color: #000000; margin: 0in;">LastPass at Black Hat 2025: Booth 5311</h2>

Stop by booth 5311 for demos, games, and (of course) swag!
&nbsp;
Demo LastPass and our new <a rel="noopener noreferrer" href="https://www.lastpass.com/features/saas-monitoring" target="_blank" style="color: inherit;"></a><a href="https://www.lastpass.com/features/saas-monitoring" target="_blank" style="color: inherit;">SaaS Monitoring</a> feature, which gives you high-level app visibility with ground-level controls. Learn how you can eliminate app blind spots in your organization and unlock the cheat code to Shadow IT.
&nbsp;
See how LastPass can help protect your business from threats &ndash; both known and unknown. Stop by for a demo and walk away with your own LED 8-bit sword.
&nbsp;
Need a break from the action? Take on a co-worker or a new conference buddy with some old school video games at our booth (calling all Street Fighter and Donkey Kong fans!).
&nbsp;
And no conference is complete without a party. Bring your short game to the GuidePoint Security Black Hat Party at Swingers &ndash; The Crazy Golf Club (at Mandalay Bay) on August 5 at 6:30pm (<a rel="noopener noreferrer" href="https://www.guidepointsecurity.com/black-hat/?utm_source=vendor&amp;utm_medium=email&amp;utm_campaign=2025_08_05_corp_mq_blackhat_party_swingers_vegas&amp;utm_vendor=last_pass" target="_blank" style="color: inherit;">register here</a>).
<h2 class="paragraph" paraid="966987688" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{14}" style="color: #000000; margin: 0in;">Black Hat 2025 Trainings</h2>

Black Hat 2025 kicks off with four days of specialized <a rel="noopener noreferrer" href="https://blackhat.com/us-25/training/schedule/index.html" target="_blank" style="color: inherit;">cybersecurity Trainings</a> (August 2-5) with courses for all skill levels. Trainings are both in-person and online (via Zoom), covering everything from pen testing, cloud security, AI and machine learning safety, incident response, malware analysis, and much, much more.
<h3 class="paragraph" paraid="1114778732" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{59}" style="color: #000000; margin: 0in;">What can you expect at Black Hat Trainings?</h3>
<ul>
 <li class="paragraph" paraid="1114778732" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{59}" style="color: #000000; margin: 0in;">Hands-on experience through immersive labs, live demos, and practical exercises for either two or four-day sessions.&nbsp;</li>
 <li class="paragraph" paraid="1114778732" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{59}" style="color: #000000; margin: 0in;">A digital <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/certifications.html" target="_blank" style="color: inherit;">Black Hat Training Certification</a> after completion.</li>
 <li class="paragraph" paraid="1114778732" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{59}" style="color: #000000; margin: 0in;">Continuing Professional Education (CPE) credits for those who are certified through ISC2 (16 credits for 2-day sessions; 32 for 4-day sessions). </li>
 <li class="paragraph" paraid="1114778732" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{59}" style="color: #000000; margin: 0in;">An extra two hours of interactive Q&amp;A with your course instructors (&ldquo;Office Hours&rdquo;), held virtually via Zoom around one month after the event.</li>
</ul>
For easier scheduling and venue navigation, be sure to download the <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/app.html" target="_blank" style="color: inherit;">Black Hat app</a>.&nbsp;
<h2 class="paragraph" paraid="374395610" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{147}" style="color: #000000; margin: 0in;">Black Hat 2025 Summit Day &amp; Briefings</h2>

<a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summits.html" target="_blank" style="color: inherit;">Summit Day</a> is Tuesday, August 5. Black Hat Summits bring together industry experts who are keen to share actionable insights on emerging technologies and topical challenges. This year&rsquo;s Summits include:&nbsp;
<ul>
 <li class="paragraph" paraid="1227558515" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{157}" style="color: #000000; margin: 0in;"><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/index.html#track/ciso-summit" target="_blank" style="color: inherit;">CISO Summit</a></li>
 <li class="paragraph" paraid="1227558515" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{157}" style="color: #000000; margin: 0in;"><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/index.html#track/ciso-summit" target="_blank" style="color: inherit;"></a><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/index.html#track/the-ai-summit" target="_blank" style="color: inherit;">AI Summit</a></li>
 <li class="paragraph" paraid="1227558515" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{157}" style="color: #000000; margin: 0in;"><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/index.html#track/the-ai-summit" target="_blank" style="color: inherit;"></a><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/index.html#track/financial-services-summit" target="_blank" style="color: inherit;">Financial Services Summit</a></li>
 <li class="paragraph" paraid="1227558515" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{157}" style="color: #000000; margin: 0in;"><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/index.html#track/financial-services-summit" target="_blank" style="color: inherit;"></a><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/#track/innovators--investors-summit" target="_blank" style="color: inherit;">Innovators &amp; Investors Summit</a></li>
 <li class="paragraph" paraid="1227558515" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{157}" style="color: #000000; margin: 0in;"><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/#track/innovators--investors-summit" target="_blank" style="color: inherit;"></a><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/omdia-analyst-summit.html" target="_blank" style="color: inherit;">Omdia Analyst Summit</a></li>
 <li class="paragraph" paraid="1227558515" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{157}" style="color: #000000; margin: 0in;"><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/omdia-analyst-summit.html" target="_blank" style="color: inherit;"></a><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/micro-summits.html" target="_blank" style="color: inherit;">Micro Summits</a> (cyber insurance, Industrial Control Systems, and supply chain)</li>
</ul>
And learn about the latest cybersecurity risks and trends at more than 100 <a rel="noopener noreferrer" href="https://blackhat.com/us-25/briefings/schedule/index.html" target="_blank" style="color: inherit;">Black Hat Briefings</a> (August 6-7), where global security pros take you through cutting-edge research. Miss a Briefing? On-demand access to all recorded Briefings will be available after the conference. (You can get 25% off Briefing tickets <a rel="noopener noreferrer" href="https://blackhat.informafestivals.com/usa/2025/registrations/SPBHP25?_pc=25-ZZYP34" target="_blank" style="color: inherit;">here</a>.)
&nbsp;
August 6-7 you can also attend <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/business-hall.html" target="_blank" style="color: inherit;">The Business Hall</a> to network with thousands of cybersecurity professionals and demo security products and solutions. It&rsquo;s the perfect place to engage and evaluate with your peers.&nbsp;
&nbsp;
Hacker summer camp is fast approaching. Get excited and <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/registration.html" target="_blank" style="color: inherit;">get registered</a> &ndash; we'll see you in Las Vegas soon!

Join LastPass at Black Hat 2025 

Join LastPass at Black Hat 2025 in Las Vegas, Nevada. 

Viva Las Vegas! Join LastPass at Black Hat 2025

Forgot your iPhone screen time password? Here’s how to reset it fast

We answer your most frustrating screen time passcode questions and reveal the easiest way to avoid forgotten passcodes and endless lockouts.

Forgot Your iPhone Screen Time Password? Here’s How to Reset It Fast

How to Reset Your Hotmail Password Quickly and Safely

Learn how to reset your Hotmail password in minutes. 

One chapter in the saga of infostealer malware has ended&mdash;at least for now&mdash;after a global law enforcement takedown of Lumma Stealer in mid-May. US, European, and Japanese authorities, with the help of tech companies including Microsoft and Cloudflare, took down, suspended, and blocked approximately 2,300 malicious domains that made up part of the infostealer&rsquo;s backbone. The FBI also seized domains that served as login panels allowing other criminals to access and use the infostealer. Although, this seizure is intended to effectively prevent criminals from being able to access Lumma to compromise computers and steal data, the overall stealer threat will remain prevalent for the foreseeable future. 
(Interested in learning more about the infostealer threat outlook? Read the LastPass TIME team&rsquo;s threat predictions and analysis on <a href="https://blog.lastpass.com/posts/2025-cybersecurity-trends">what direction infostealers and other threats are heading</a>.) 
<h2>What is Lumma?</h2>
 
Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022. Since its initial release, Lumma&rsquo;s developers have released multiple upgraded versions of the software. Before the malware-as-a-service (MaaS) platform was dismantled, the FBI linked Lumma to around <a href="https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted">10 million infections</a> globally. Lumma&rsquo;s follow-on attacks involving stealing credentials, cryptocurrency data, and credit card information have resulted in an estimated <a href="https://cyberscoop.com/lumma-infostealer-widespread-victims/">$36.5 million USD</a> in credit card theft in 2023. The malware hit individuals and a wide range of industries, including Fortune 500 companies, airlines, universities, banks, and hospitals. 
What makes this stealer particularly effective is that it continues to evolve to bypass security layers even as defenders are responding to the threat. On top of grabbing browser-stored passwords and cookies, it&rsquo;s also capable of extracting autofill data, email credentials, File Transfer Protocol (FTP) data, and two-factor authentication tokens and backup codes. Using its MaaS platform, its creators sold access to the malware on multiple underground markets and platforms like Telegram. 
<h2>What comes next?</h2>
 
This takedown is a major win for law enforcement and will help disrupt the initial access broker ecosystem in the near term. However, this is an ecosystem that has demonstrated its resilience again and again. The number of existing infostealer families, the open access to numerous source codes of previous infostealers, and the constant demand create a lucrative environment with very low barriers to entry. Given the resiliency of this market, other infostealer will likely quickly step in and fill in the gaps left after the Lumma takedown. 
A similar pattern previously played out with other similar takedowns. On October 28, 2024, Operation Magnus disrupted the RedLine and META infostealers. RedLine was a significant stealer last year up until the takedown, after which Lumma grew in popularity and took over a portion of the market share previously held by RedLine. Redline infected 9.9 million hosts, or 43% of all infostealer infections observed by Flashpoint in 2024. The next four most-prolific infostealers in 2024, including RisePro, SteaC, Lumma Stealer, and Meta Stealer, infected a <a href="https://cyberscoop.com/infostealers-cybercrime-surged-2024-flashpoint/">combined 7 million hosts</a>. 
We expect to see something similar following the Lumma Stealer takedown operation. The disruption effect following takedown is real, but there are still some new infections and logs for sale that were likely stolen before the infrastructure was taken down. Additionally, just because Lumma&rsquo;s infrastructure was dismantled, a lot of the data it stole likely continues to live on the dark web&mdash;thanks to the cybercriminal ecosystem that resells this information. Additionally, <a href="https://blog.checkpoint.com/security/lumma-infostealer-down-but-not-out/">CheckPoint</a> reported Lumma&rsquo;s developers are already trying to rebuild and restart their operations, which may or may not be successful.&nbsp;As SpyCloud&rsquo;s <a href="https://www.linkedin.com/posts/thilligoss_lummatakedown-lummareallynowork-stealc-activity-7332888157480198146-u94p">Trevor Hilligoss shared</a>, daily new Lumma infections have trended downward following the takedown but not as much as expected. Continued monitoring will be necessary to determine the takedown&rsquo;s impact. 
Long-standing groups such as Vidar and Stealc are good examples of this, but other newer families, such as Acreed, will also be well positioned to increase their market share. <a href="https://www.bleepingcomputer.com/news/security/russian-market-emerges-as-a-go-to-shop-for-stolen-credentials/">ReliaQuests</a> already reported Acreed is rapidly gaining traction following the Lumma takedown. <a href="https://webz.io/dwp/acreed-infostealer-everything-we-know-so-far/">Over 4,000 logs</a> stolen by Acreed were reportedly uploaded to the Russian Market within its first week of operations.&nbsp;Nexus has also gained some traction over the last week in Lumma&rsquo;s absence. Further, former affiliates and/or administrators associated with Lumma itself may split off to create their own offerings.

<img src="https://cdn.lputil.com/-/media/ffef2d4ef9d544babc2169a6d0274059.jpg?h=310&amp;w=624" >&nbsp;
Daily new LummaC2 infections (Source: Trevor Hilligoss)
<h2>How to protect yourself against infostealers</h2>
The threat from infostealers will remain very real for the foreseeable future and continue to adapt. Oftentimes, stealers are used in indiscriminate campaigns. Additionally, the sheer volume of data that has been dumped on the internet is immense. That means anyone is fair game and should take action to protect themselves following that assumption that they could be targeted. 
<ul>
 <li>Use strong, unique passwords for every account. This will prevent credential stuffing attacks, which is a common tactic where threat actors insert stolen usernames and passwords. That way, if one password is exposed, it won&rsquo;t give access to all your other accounts where you reuse the same password. Also, consider using a password manager to securely and conveniently store them.</li>
 <li>Enable MFA on your accounts. While this measure isn&rsquo;t failproof on its own, it adds an additional layer of defense and makes you a harder target.</li>
 <li>Be on guard for phishing attempts. Infostealers often spread through phishing emails and malicious downloads. </li>
 <li>Check HaveIBeenPwned to monitor potential exposure if you&rsquo;re worried you may have been infected by an infostealer. </li>
</ul>

What the Lumma stealer takedown means for the infostealer market and your personal data

Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkey vs Password: Which is More Secure? | LastPass

Explore the differences between passkeys and passwords. Learn how LastPass enhances security and simplifies access with advanced authentication methods.

Blog

Blog

Recent

Industry News

Cybersecurity

LastPass For Admins

LastPass Labs

Product Updates

Tips And Tricks

Introducing Secure Access Experiences: Controlling the Chaos of Modern App Sprawl

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkeys Explained: Will Passwords Ever Go Away?

The Enemy You Can’t See: How to Defend Yourself Against Computer Viruses

Reset Your Comcast Email Password and Boost Your Online Security Now

Subscribe & Save 20% off select plans

McHack’d: How Weak AI Credentials Served Up a Data Breach

It’s Time for a New Password Manager: Dropbox Passwords Is Shutting Down

Lumma Persists and Acreed Rises Following Law Enforcement Actions

Forgot Your iCloud Password? Here’s How to Reset It

Cyber Threats in APAC: What We Covered in the First Episode of The Phish Bowl

LastPass Business Max Now Available on AWS Marketplace

Lost Your Snapchat My Eyes-Only Passcode? How to Fix It Fast

Viva Las Vegas! Join LastPass at Black Hat 2025

Forgot Your iPhone Screen Time Password? Here’s How to Reset It Fast

How to Reset Your Hotmail Password Quickly and Safely