You might have seen <a href="https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024">this shocking prediction from Gartner:</a> by 2027, 75% of employees will acquire, modify or create technology outside IT&rsquo;s visibility &ndash; up from 41% in 2022.&nbsp;
Your employees rely on more SaaS tools than ever and not all of them are on your radar. &nbsp; 
From cloud apps and browser extensions to AI tools, today&rsquo;s workplaces move fast. And when anyone can implement a new app with little more than a credit card and a dream, you can be sure that very few of them are thinking about access or credential management. Consider this:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Shadow IT and Shadow AI are expanding the attack surface, with unsanctioned tools introducing security gaps no one&rsquo;s monitoring.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">App bloat is costing real money &mdash; small businesses now pay for an average of 134 unused applications, and large organizations pay for 473.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Sensitive data is slipping through the cracks, with 38% of employees admitting they&rsquo;ve shared work information with unauthorized AI tools.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Compliance is harder to maintain when there&rsquo;s no clear picture of who&rsquo;s accessing what, and from where.&nbsp;</li>
</ul>
Single sign-on (SSO) can help with your core apps-- the ones that you know about-- but it doesn&rsquo;t cover everything, especially those smaller, hidden apps. And for small and mid-sized businesses, controlling those can get expensive and time-consuming, fast.&nbsp;&nbsp;
That&rsquo;s where the security gaps start. Without a simple, customizable way to manage access, secure credentials and monitor app usage, it&rsquo;s easy to lose control. And that opens the door to risk from old accounts that still have access to sensitive info, to apps no one remembers signing up for.&nbsp;
It&rsquo;s no longer enough to secure passwords alone. Businesses need an approach to identity and access management that&rsquo;s as flexible, efficient, and user-friendly as the tools their employees actually use.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">What is Secure Access Experiences?&nbsp;&nbsp;</h2>
Secure Access Experiences is the LastPass answer to this growing access management crisis &mdash; an evolving approach designed to bring together essential capabilities into one intuitive experience. It helps you control who has access to what, based on your own policies &mdash; not just passwords. Whether your team is using approved tools or ones you didn&rsquo;t even know about, you&rsquo;ll get the visibility and control you need, all in one easy-to-use solution.&nbsp;
With Secure Access Experiences, you will be able to:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Log in with ease: Securely manage how your team stores and uses passwords. Support for passkeys makes logging in even faster and safer.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Control who gets access: Make sure the right people have access to the right apps, systems, and data&mdash;nothing more, nothing less. It&rsquo;s easy to set up and adjust as your business grows.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">See what&rsquo;s happening: Know which apps your team is using, when, and how. Stay informed, spot issues early, and feel confident that everything&rsquo;s running smoothly.&nbsp;&nbsp;&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Why do Secure Access Experiences matter?&nbsp;</h2>
As SaaS adoption grows and the lines between personal and professional tools blur, businesses need a smarter, simpler way to manage access &mdash; one that meets modern challenges head-on, without overwhelming teams or breaking the bank.&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Grows with your business: As your business adds more tools, people, and locations, LastPass makes it easy to keep everything secure without slowing you down.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Easy to manage, easier on your budget: Control access to all your tools from one place. Less hassle for you, and no need to invest in multiple systems.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Provides better protection, fewer headaches: Keep your business safe with strong, simple security&mdash;and make it easier to meet industry requirements along the way.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Simple for your team to use: When it&rsquo;s easy to use, your team actually uses it. That means stronger habits, less risk, and happier employees.&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">It starts with SaaS Monitoring and SaaS Protect.&nbsp;</h2>
You can&rsquo;t control what you can&rsquo;t see. The first capability in Secure Access Experiences was&nbsp;SaaS Monitoring. Now, SaaS Protect is available so that customers can take action on that visibility.&nbsp;&nbsp;&nbsp;
<img src="https://cdn.lputil.com/-/media/2b6fd9bba92346a8a0fcedeca39eed06.png?h=824&amp;w=1250" >
<p class="Paragraph SCXW34306727 BCX0" paraid="543943140" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{232}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">With SaaS Monitoring and SaaS Protect, business owners and IT admins can finally see what apps are being used across their organization, spot risky behavior, and make informed decisions about which apps to allow, restrict, or retire. helping them detect unapproved tools, spot Shadow IT and Shadow AI, and optimize application investments &mdash; all without the need to deploy extra agents, integrations, or complexity.
<p class="Paragraph SCXW34306727 BCX0" paraid="713470910" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{238}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">The future of easier visibility and control is here. Start your Secure Access Experiences journey today.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>

Introducing Secure Access Experiences: Controlling the Chaos of Modern App Sprawl

Secure Access Experiences is the LastPass answer to this growing access management crisis.

Get LastPass Free

Create and store secure passwords for yourself, your team or business.

Why LastPass?

Remember fewer passwords and log in faster with our browser extension.

How LastPass works

LastPass zero-knowledge security model keeps your data private even from us.

Security Architecture

Compare LastPass competitors, plans, and features in one place

Compare LastPass

Overview

Password management

Save and autofill

Password generator

Password sharing

Passkeys

Dark web monitoring

Security dashboard

Key Features

Free LastPass Premium trial, no credit card required.

Free LastPass Business trial, no credit card required.

Let our experts help you find the right plan and successfully deploy LastPass.

Sync passwords across all devices, monitor password health, data breaches and much more.

Personal

Premium password management for family or group of 6 people.

Families

Personal Plans

Password vault

Save & autofill

Automatic device sync

Emergency access

Personal password sharing

FOR INDIVIDUALS

30-day free LastPass Premium trial, no credit card required.

30-day free LastPass Families trial, no credit card required.

Limited to 1 device type and basic password management features.

Designed for businesses of all sizes, from small startups to enterprises.

Business

Simplify secure access straight from the browser with more admin control.

Business Max

For single teams just getting started with password management.

Teams

Designed to keep your clients' credentials protected and private.

Business Plans

User management

SaaS Monitoring

SaaS Protect

Business sharing

Multifactor Authentication

Integrations

Single Sign-on

Identity management

For admins

Marketing teams

Legal teams

HR teams

Business leaders

IT admins

Solutions by role

Case studies

Webinars

Product demos

Events

Trust Center

Compliance Center

Security architecture

LastPass University

Resource Center

Pricing

Join the LastPass Partner Program to provide even more value to your customers.

Partner program overview

Managed Service Providers

Resellers

Cloud marketplaces

Technology Alliance Partners

LastPass Partner Program

Grow new revenue streams by meeting customer's security needs.

Looking for help or interested in becoming a LastPass partner? Get in touch with our partner team.

Connect with trusted LastPass Partners to support your security needs.

Partners

Self-service library of resources and guides for all LastPass products.

Support Center

Community forum

System status

Help

Personal support for all LastPass’ subscribed customers.

Support

Get LastPass free

Submit sales inquiry

Chat with sales

Request a demo

Find a partner

Contact sales

Log in

What is server side request forgery? 

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">SSRF allows attackers to trick your server into&nbsp;fetching resources from your internal IP&nbsp;addresses&nbsp;or cloud metadata endpoints.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">The key difference between CSRF&nbsp;(cross site request forgery)&nbsp;and SSRF&nbsp;(server side&nbsp;request forgery)&nbsp;is that they target completely different victims.&nbsp;&nbsp;While CSRF targets your customers, SSRF attacks your&nbsp;business.&nbsp; &nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">SSRF attacks have surged 452% because they allow attackers to bypass&nbsp;your&nbsp;edge or perimeter firewalls.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">OWASP battle-tested libraries can unmask the hex, octal, and mixed encodings that attackers use to bypass your IP validation filters.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Do&nbsp;over-permissioned&nbsp;internal services and&nbsp;admin/dev logins&nbsp;keep you up at night?&nbsp;LastPass Business Max complements&nbsp;metadata access&nbsp;controls&nbsp;to&nbsp;keep your business safe.&nbsp;</li>
</ul>

Key takeaways: Server-side request forgery 

FAQs: Server side request forgery

SSRF allows attackers to trick your server into fetching resources from your cloud metadata endpoints. LastPass Business Max complements metadata access controls to keep your business safe.

SSRF Attacks Are Up 452%: Here’s Your 5-Minute Business-Friendly SSRF Prevention Guide

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Cross site request forgery (CSRF) is an attack that exploits the trust your app has in authenticated users.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Imagine your site processing transactions your customers never approved:&nbsp;A&nbsp;CSRF&nbsp;attack&nbsp;is&nbsp;deadly for business.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">There are three (3) conditions that make a CSRF attack more likely, and #3 takes advantage of a universal habit.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Talking with your dev team about CSRF means&nbsp;starting&nbsp;a discussion about the smart protections already in place.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Fighting back against CSRF&nbsp;involves&nbsp;properly configured&nbsp;SameSite&nbsp;settings,&nbsp;use of&nbsp;CSRF tokens,&nbsp;Origin/Referer&nbsp;validation, strong identity controls&nbsp;with LastPass, and prohibiting GET state-changing requests.&nbsp;</li>
</ul>

Key takeaways: Cross site request forgery

FAQs: Cross site request forgery

<div id="calloutcontent1">&nbsp;</div>
Cross site request forgery&nbsp;(C[..]

What Is Cross Site Request Forgery? The 5-Minute CSRF Guide for Business Owners

Strengthening Cyber Resilience Through Partnership: Insights from Australia and New Zealand

LastPass Senior Threat Intelligence Analyst Mike Kosak reflects on his recent travel to Australia and New Zealand to meet with customers and Australian and New Zealand government representatives. One of the common themes that arose consistently across my conversations was the importance of partnerships within cybersecurity. 

online scams 

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">&ldquo;But they seemed&nbsp;so real&rdquo; puts you in danger. Always verify before you&nbsp;trust.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Real businesses or federal agencies will never demand payment in&nbsp;gift cards, cryptocurrency, or wire transfers.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">You&nbsp;aren&rsquo;t&nbsp;the target because&nbsp;you&rsquo;re&nbsp;gullible.&nbsp;You&rsquo;re&nbsp;the target because&nbsp;you&rsquo;re&nbsp;human.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Scammers sell feelings, urgency, and FOMO.&nbsp;Unrealistically &ldquo;perfect&rdquo;&nbsp;promises are warning signs&nbsp;(guaranteed riches, instant cures). Trust your gut and walk away.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Your memory may play tricks on you.&nbsp;But your&nbsp;&ldquo;safe words&rdquo; and sensitive info&nbsp;are&nbsp;secure&nbsp;and accessible with&nbsp;LastPass.&nbsp;</li>
</ul>

Key takeaways: Online scams

FAQs: Online scams

20 must-know online scams and your 2026 defense guide. 

Online Scam Alert: 20 Must-Know Online Scams + Your 2026 Defense Guide 

<div id="calloutcontent1">&nbsp;</div>
Season&rsquo;s greetings from all of us here at LastPass and The Phish Bowl. We have a great new episode and corresponding regional report for you all on updates to the North American threat landscape. But first, as 2025 comes to an end, I wanted to pause for just a second and thank my amazing co-host Mike Kosak, our listeners, and recognize the entire team behind the scenes that&rsquo;s made this podcast possible. As we wrap up 2025, it&rsquo;s amazing to look back and see what we&rsquo;re building together over the last six episodes. A community of curious minds who want to understand what&rsquo;s really driving cyber threats in our world. We can&rsquo;t wait to see what 2026 has in store. 
So, without further ado, let&rsquo;s dive into the latest episode of The Phish Bowl together where we cover cyber threat analysis of common holiday scams and threat predictions for next year. We&rsquo;re joined by our fellow LastPass teammates Jordan Sher, our new podcast co-host and Vice President of Marketing, and Alex Cox, Director of the Threat Intelligence, Mitigations, and Escalations (TIME) team. 

<iframe width="560" height="315" src="https://www.youtube.com/embed/A_CF0vrH8TI?si=ofnCLdsRfrez4qwo" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen=""></iframe>

<h2>What types of holiday scams should you look out for? </h2>
Holidays are prime for cyber crooks taking advantage of the end of year online shopping rush. It&rsquo;s that time of year when our inboxes and text messages are blown up by advertisements, promotional deals, and delivery notifications for the slew of packages to put under the tree. That makes it more likely for people to click on a lot of stuff they wouldn&rsquo;t normally click on. Cybercriminals take advantage of this and try to blend in as legitimate emails. Mobile targeting has become more common too, with more<a href="https://blog.lastpass.com/posts/smishing-vs-vishing"> smishing (text phishing) and vishing (voice phishing)</a> attacks, as people spend more time on their phones. These scams frequently promise to offer promotions that seem too good to be true (because they are) and try to pressure you into quickly taking some kind of action, which is a common tactic and dead giveaway that this is a scam. Common types of <a href="https://www.rd.com/article/holiday-shopping-scams-2025/">holiday scams</a> include the following: 
<ul>
 <li>Delivery notifications &ndash; With lots of packages being delivered this time of year, there are more fake notifications via text pretending to be package delivery alerts requiring some type of action, such as paying a tariff, to receive the alleged package. </li>
 <li>Unpaid tolls &ndash; Toll collection scams were already prevalent this year and will likely increase during holiday travel periods as more people are traveling on the road and therefore more likely to believe the scam, oftentimes handing over credentials or money. </li>
 <li>Gift cards &ndash; Everybody gets gift cards this time of year, and cybercriminals have always taken advantage of that. Scammers may advertise discounted gift cards that are unusable in exchange for victims&rsquo; payment information. </li>
</ul>
Consider this as your friendly neighborhood reminder not to click on any link that you don&rsquo;t recognize and watch out for suspicious calls, text, and emails to stay safe online this holiday season.
<h2>North America regional threat report</h2>
The overall trend in cybersecurity indicates a continuously challenging environment for North American entities. The United States continues to be the primary target within the region due to its significant attack surface, with Canada also experiencing a high volume of activity. Financially motivated activities, cyberespionage, information operations, and hacktivism are expected to remain key threats, with new trends emerging in the exploitation of AI and the targeting of critical infrastructure and supply chains. Check out <a href="https://info.lastpass.com/threat-reports">the latest North American threat report</a> for a deeper dive on the latest regional trends. 
<h2>2026 cybersecurity threat analysis: identity, critical infrastructure, supply chain, and AI risks</h2>
Seeing into the future isn&rsquo;t as complicated as trying to read a crystal ball when we have our fingers on the pulse. Monitoring threat activity and identifying trends this year helps us see and prepare for the threats that are coming down the pipeline. Looking ahead at 2026, these are some of the key trends we are anticipating. 
Identity in the crosshairs&nbsp;
It seems like most cyber threat activity these days comes back to compromising identities, often in the form of stolen credentials. Looking ahead to 2026, we expect to see attackers continue to aggressively <a href="https://lastpassinc-my.sharepoint.com/personal/stephanie_keinz_lastpass_com/Documents/Articles/Phish%20Bowl%20podcast%20summary/o%09https:/www.lastpass.com/resources/learning/identity-theft-protection-begins-with-identity-management">target identities</a> to enable attacks. They will likely adapt their methods as passkeys are increasingly adopted to exploit related weaknesses (like finding weaknesses in account recovery and reset requests instead of stealing passwords themselves) and focus more on stealing browser cookies as MFA is increasingly rolled out (to inject themselves into active sessions rather than trying to steal or intercept MFA codes). Artificial intelligence (AI) will amplify this threat. For instance, <a href="https://blog.lastpass.com/posts/generative-ai-and-phishing">AI-powered phishing</a>&nbsp;scams combined with the use of leaked credentials led to $262 million in losses in 2025. 
Critical infrastructure under threat
Critical infrastructure is a common target for cybercriminals, nation-state actors, and hacktivists, and this threat has been increasing over time. Concerning threats to the private sector, some companies may have secondary or tertiary connections with critical infrastructure that they aren&rsquo;t aware of and could face business continuity disruptions if that critical infrastructure goes down. Notably, the upcoming elections in the United States are coming up in 2026, and there&rsquo;s a real chance that election infrastructure will be targeted. 
Reimagined supply chain attacks
Attackers have increasingly targeted supply chains because they can conduct widespread attacks using relatively little effort. In 2026, we expect attackers will increasingly focus on open-source supply chain compromise, like the recent NPM attacks, like the recent wave of attacks compromising NPM packages with the Shai-Hulud worm. 
The AI of it all
AI will make hackers&rsquo; jobs easier, allowing them to conduct attacks faster, at bigger scale, and just generally better.
<h2>Listen to the full episode&nbsp;&nbsp;</h2>
Catch the full episode and additional resources for more cyber threat insights from the LastPass Threat Intelligence, Mitigations, and Escalations (TIME) Team. 
<ul>
 <li>Listen to the full episode of The Phish Bowl wherever you get your podcasts:&nbsp;&nbsp;
 <ul>
 <li><a rel="noopener noreferrer" href="https://www.youtube.com/@LastPass/podcasts" target="_blank">YouTube</a>&nbsp;</li>
 <li><a rel="noopener noreferrer" href="https://open.spotify.com/show/1TQiFDk9acmkfp1sTFN1yX" target="_blank">Spotify</a>&nbsp;</li>
 <li><a rel="noopener noreferrer" href="https://podcasts.apple.com/podcast/id1828511920" target="_blank">Apple</a>&nbsp;</li>
 </ul>
 </li>
 <li>Subscribe for monthly threat intel deep dives.&nbsp;</li>
 <li>Access LastPass's <a href="https://info.lastpass.com/threat-reports">Regional Report</a> for detailed analysis of recent North American trends and activity.&nbsp;</li>
 <li>Check out the <a rel="noopener noreferrer" href="https://blog.lastpass.com/categories/threat-intel" target="_blank">LastPass Threat Intel blog</a> for more insights.&nbsp;</li>
</ul>
Looking forward to seeing you all in the New Year to talk about Asia-Pacific cyber threats!

The Phish Bowl explores what’s inside the 2026 cybersecurity crystal ball: identity, AI & new threats

<ul>
 <li>Online scams are common during the holidays. Cybercriminals want to take advantage at a time when folks have their guards down and are more likely to click on holiday related scams.  </li>
 <li>Some of our key threat predictions for 2026 include identity compromise, critical infrastructure, and supply chain attacks.  </li>
 <li>Identity compromise is one of the largest threats enabling data breaches, ransomware attacks, and other malicious cyber activities. This includes both human and non-human identities like machines and applications.  </li>
 <li>Threat actors are increasingly targeting critical infrastructure which can have widespread disruptions on the private sector via operational dependencies.  </li>
 <li>Supply chain attacks are a golden ticket for hackers, offering a big return on investment by enabling widespread impact to upstream or downstream victims via initially compromising a single source.   </li>

</ul>

Key takeaways: Holiday scams and 2026 threat predictions

<div id="calloutcontent1">&nbsp;</div>
Season&rsquo;s greetings from all of us here at LastPass and The Phish Bowl. We have a great new episode and corresponding regional report for you al[..]

model poisoning

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">In model poisoning, the real damage happens inside parameters.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">In an AI&nbsp;model, parameters come in two types: biases and weights.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">&ldquo;Biases&rdquo;&nbsp;aren&rsquo;t about fairness. Along with &ldquo;weights,&rdquo; they&nbsp;help&nbsp;an AI&nbsp;return&nbsp;more&nbsp;accurate&nbsp;responses&nbsp;over time.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">The difference between model poisoning and data poisoning lies in how the attacker chooses to attack the model.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">There are three things you must do to detect model poisoning,&nbsp;and all of them have one thing in common: vigilance.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">From sandboxing to data version control, eight tactics help you block model poisoning. Yet #7&rsquo;s adversarial nature might be the&nbsp;only one that fights&nbsp;fire with fire, which is exactly why&nbsp;it&rsquo;s&nbsp;likely to work.&nbsp;</li>
</ul>

Key takeaways: Model poisoning 

FAQs: Model poisoning

Your first line of defense for model poisoning is strong access controls for training data, like LastPass. 

AI Model Poisoning in 2026: How It Works and the First Line Defense Your Business Needs 

What are botnet attacks?

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">At any given time, millions of everyday devices are part of invisible botnet armies their owners know nothing about.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Bots can steal your info, automate credential stuffing, scrape information off your site, harvest your data from social media platforms, and use your device for crypto mining.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Botnets don&rsquo;t form by accident. Attackers create them by infecting your device with malware that, once executed, connects to a C2 server. From there, your device reports for duty in an army that never sleeps.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Router changes, skipping security feeds, and 3AM surges in network traffic. Maybe it&rsquo;s nothing...or the first hint your devices have already joined a botnet army.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">There are several ways to fight back: Enforcing MFA, deploying bot detection &amp; mitigation, hardening routers. But LastPass SaaS Monitoring &amp; Protect takes it to the next level, flagging threats 24/7 even when you sleep.</li>
</ul>

Key takeaways: Botnet attacks

FAQs: Botnet attacks

Bots can steal your info, automate credential stuffing, scrape information off your site, harvest your data from social media platforms, and use your device for crypto mining. 

Could Your Device Be Part of a Botnet Without You Knowing?

Autofill Gets Even Better on Mobile: New iOS and Android Updates

We’re excited to share new autofill improvements coming to both iOS and Android designed to save you time and reduce friction. 

Account takeover attacks

FAQs: Account takeover

Combine LastPass Business Max with identity protection services for optimum security against account takeovers. 

How Did Account Takeover Attacks Lead to More than $262 million in Losses This Year, and Were You a Target? 

<div id="calloutcontent1">&nbsp;</div>
Welcome to The Phish Bowl, a cybersecurity podcast hosted by seasoned cyber threat intelligence analysts Mike Kosak and myself, Stephanie Schneider. We decode the latest global risks and digital defense strategies. Each month, we dive deep into emerging cyber threats, advanced persistent actors, and the evolving tactics shaping the security landscape. Whether you&rsquo;re a CISO, security researcher, IT professional, or policy leader, this podcast delivers actionable intelligence and thought leadership to help you anticipate and defend against tomorrow&rsquo;s cyber challenges. 
In our <a href="https://www.youtube.com/watch?v=tChAUCJY0w0&amp;list=PLsXN_jRonzye7EZC-aiKFxGyAFUlbBRop&amp;index=1">November episode</a>, we turn our focus to Europe&rsquo;s threat landscape. For our special guest, we'll be speaking with Lauren Goldman, the Former Director of Analytic Integration at the Office of the Director of National Intelligence&rsquo;s Cyber Threat Intelligence Integration Center about the impact to information sharing and critical infrastructure security as the US government draws down the Cybersecurity and Infrastructure Security Agency (CISA) and the potential implications if Cybersecurity Information Sharing Act of 2015 (CISA 2015) lapses.
We&rsquo;re now firmly in the middle of the holiday season, between Thanksgiving and the end of the year, which is a busy time of year trying to wrap up pending work tasks by end of year while simultaneously crossing items off our gift lists. Mike and I really seem to be feeling it because we both had similar responses to the question, &ldquo;What movie title we would give to our lives in this exact moment if they were movies?&rdquo; Mike came up with &ldquo;Fumbling Towards the Future,&rdquo; while my response was &ldquo;Speeding Towards the Edge.&rdquo; &ldquo;What edge?&rdquo; Mike asked. Good question, Mike&hellip;perhaps the bleeding edge of enlightenment, or at the precipice of losing my sanity, whichever way you want to interpret that. Guess we&rsquo;ve all got to hang on because it&rsquo;s going to be a wild ride heading straight into the end of the year! 
<div id="calloutcontent1">&nbsp;</div>
<iframe width="777" height="437" src="https://www.youtube.com/embed/tChAUCJY0w0?list=PLsXN_jRonzye7EZC-aiKFxGyAFUlbBRop" title="Back to Europe: DDoS, Ransomware, and Hacktivists" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe>
&nbsp;
<h2>Europe cyber threat assessment: Which industries are on the most targeted list? </h2>
<a href="https://blog.lastpass.com/posts/ransomware">Ransomware</a> and extortion pose some of the biggest threats to Europe and continue to impact the region in a major way. 
Europe has become the second most targeted region for ransomware and extortion, and ransomware was identified as the most impactful threat in the EU by <a href="https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf">ENISA&rsquo;s Threat Landscape Report 2025</a>. The region accounts for approximately <a href="https://www.crowdstrike.com/en-us/resources/reports/2025-european-threat-landscape-report/">22% of victims</a> worldwide, with the UK, Germany, Italy, France and Spain being the most heavily targeted countries. This trend has continued as ransomware attacks reached record levels across the region in Q3 2025 and <a href="https://industrialcyber.co/threats-attacks/comparitech-reports-ransomware-surges-25-in-october-hitting-manufacturers-healthcare-transportation/">surged 25%</a> on a global level in October. 
Qilin was the most active ransomware group targeting the region from January 1 through October 31, followed by Akira and Safepay. High-value industries frequently under attack included Manufacturing, Legal &amp; Professional Services, Construction &amp; Engineering, Retail, and Technology. The increasing adoption of AI-enhanced phishing and social engineering, designed to facilitate ransomware deployment and other malicious activities, poses a significant and growing threat.
<h2>Which critical infrastructure and key resources are attackers targeting in the EU?</h2>
Critical infrastructure faces greater risk than other sectors because it is an attractive target for diverse threat groups and often suffers from weaker security standards due to limited funding and resources. Attacks on critical infrastructure that are paired with ransomware and supply chain compromise can be even more impactful. 
Financially motivated groups realize this sector cannot afford to be down for long and so may be more willing to pay ransom or extortion demands to get back online quickly. For instance, the Collins Aeorspace attack the Everest ransomware gang claimed in September had significant impact, combining ransomware and supply chain attacks. This incident caused flight delays and cancellations across multiple airports including major hubs at Heathrow, Brussels, Berlin, and Dublin. Nation-states and hacktivists have also targeted European critical infrastructure for espionage and pre-positioning in the event of an active conflict and disruption, respectively. 
Our special guest Lauren Goldman talked about how critical infrastructure is interconnected and essential to our collective security. When something in one critical sector goes down, it can have cascading effects in other areas.
<h2>Why is information sharing critical in cybersecurity? </h2>
Information sharing is critical for our collective defense. A rising tide lifts all ships. We are all safer when we can share information that can be used to protect ourselves by having a leg up on attackers. 
Lauren discussed several recent changes around information sharing, both internal and external to the United States. When it comes to information sharing around critical infrastructure, Lauren explained there&rsquo;s less government visibility into what&rsquo;s happening because a lot of critical infrastructure is privately owned and operated by small businesses that are not necessarily resourced to protect against cyber threats. With the expiration of the Cybersecurity Information Sharing Act (CISA 2015) on September 30 and no clear path forward for its reauthorization, private industry may feel more apprehensive about sharing with government now that the previous legal systems that were in place to protect them are now gone. 
A separate program, known as the State and Local Cybersecurity Grant Program (SLCGP), expired at the same time as CISA 2015. These are two distinct programs but are being managed and extended together since mid-November. SLCGP provides federal funding to state, local, tribal, and territorial governments to enhance their cybersecurity defenses. 
The Cyberspace Solarium Commission (CSC) was another information sharing effort with a broad mandate to develop a national strategy to defend against cyber threats. It started as&nbsp;a United States bipartisan, congressionally mandated intergovernmental entity&nbsp;that ended as a government entity in December 2021 and transitioned its work into a non-profit called CSC 2.0. There was a realization that government agencies could help fill intelligence sharing gaps between the public and private sectors, sharing valuable, actionable information with private-sector individuals with government clearances. 
When intelligence provided by these information sharing groups is taken away, that also diminishes resources and our collective resilience. If these programs were to end, this would negatively impact us all and prevent our ability to warn others of emerging and active threats. 
Note: At the time of the podcast recording, CISA 2015 had expired. CISA 2015 was recently temporarily reauthorized in mid-November through January 30, 2026; however, the path for a more permanent reauthorization is currently unclear.
<h2>Underrated threats we shouldn&rsquo;t ignore: hacktivism and DDoS</h2>
Lastly, we can&rsquo;t discount simpler attacks from hacktivists and distributed denial-of-service (DDoS), especially when it comes to potential impact for small to midsize businesses (SMBs). These approaches are still very effective against organizations that may not have the same high-level protection in place of a financial institution, for instance. The assumption that just because you're a small organization means that you're not going to be on the radar of cybercriminal groups isn&rsquo;t the case. Ransomware and other cybercriminal groups go after these smaller, lesser resourced organizations because they assume they&rsquo;re easier targets. 
As an example, the pro-Russian hacktivist group NoName057(16) has targeted different countries in Europe for their pro-Ukraine stance. The group is associated largely with DDoS attacks and has successfully taken down services of critical infrastructure services across Europe. Since November 2023, German authorities have recorded <a href="https://therecord.media/international-police-takedown-noname-hacker">14 waves of attacks affecting more than 250 entities</a>. While most attacks have caused minimal disruption, the group&rsquo;s decentralized model and use of botnets has been described as an escalating threat.
<h2>Listen to the full episode&nbsp;&nbsp;</h2>
Catch the full episode and additional resources for more cyber threat insights from the LastPass Threat Intelligence, Mitigations, and Escalations (TIME) Team. 
<ul>
 <li>Listen to the full episode of The Phish Bowl wherever you get your podcasts:&nbsp;&nbsp;<a rel="noopener noreferrer" href="https://www.youtube.com/@LastPass/podcasts" target="_blank"></a>
 <ul>
 <li><a rel="noopener noreferrer" href="https://www.youtube.com/@LastPass/podcasts" target="_blank">YouTube</a>&nbsp;</li>
 <li><a rel="noopener noreferrer" href="https://open.spotify.com/show/1TQiFDk9acmkfp1sTFN1yX" target="_blank">Spotify</a>&nbsp;</li>
 <li><a rel="noopener noreferrer" href="https://podcasts.apple.com/podcast/id1828511920" target="_blank">Apple</a>&nbsp;</li>
 </ul>
 </li>
 <li>Subscribe for monthly threat intel deep dives.&nbsp;</li>
 <li>Access LastPass's <a href="https://info.lastpass.com/threat-reports">Regional Report</a> for detailed analysis of recent Europe trends and activity.&nbsp;</li>
 <li>Check out the <a rel="noopener noreferrer" href="https://blog.lastpass.com/categories/lastpass-labs" target="_blank">LastPass Labs blog</a> for more insights.&nbsp;</li>
</ul>
We&rsquo;ll be back next month to talk about threat activity and trends in North America, along with a corresponding regional report!

<ul>
 <li>Ransomware and extortion pose some of the biggest threats to Europe and continue to significantly impact the region.&nbsp; </li>
 <li>Critical infrastructure faces a range of threats from cybercriminals, hacktivists, and nation-state actors and is particularly vulnerable due to generally weaker cybersecurity standards.&nbsp; </li>
 <li>Information sharing is critical for our collective defense, but these efforts currently face challenges due to potential policy changes.&nbsp; </li>
 <li>Hacktivists and distributed denial-of-service (DDoS) attacks are frequently underestimated but can have consequential impacts, especially when it comes to small to midsize businesses (SMBs).</li>
</ul>

Key takeaways: European and Global Threats – DDoS, Ransomware, and Hacktivists

<div id="calloutcontent1">&nbsp;</div>
Welcome to The Phish Bowl, a cybersecurity podcast hosted by seasoned cyber threat intelligence analysts Mike Kosak and myself, Stephanie Schneider. [..]

The Phish Bowl: Back to Europe – DDoS, Ransomware, and Hacktivists

<div class="OutlineElement Ltr SCXW123377749 BCX0" style="color: #000000; background-color: #ffffff; margin: 0px; padding: 0px;">
<h2 class="p1" style="color: #0f374e; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;">Risk has evolved, and we have too</h2>
As the pioneer of credential management, LastPass has always set the standard for protecting logins, users, and data. But as today&rsquo;s workforce has evolved, the challenge has too. SaaS and AI tools are fueling productivity like never before, empowering employees to move faster, automate more, and innovate on their own&mdash;but that innovation comes with a hidden cost. Every new app spun up without IT approval adds blind spots, credential risk, and compliance exposure that most businesses&nbsp;don&rsquo;t&nbsp;even realize exist. What starts as innovation quickly turns into risk.
&nbsp;
For small and midsized businesses (SMBs) and managed service providers (MSPs) specifically, this is an ever-growing nightmare. The legacy tools designed to fix it, like enterprise-grade SSPMs, CASBs, and sprawling IAM suites, are too complicated, too expensive, and too noisy for lean IT teams who just need clear, actionable insight into their SaaS risk landscape. They&nbsp;don&rsquo;t&nbsp;have time to wrestle with integrations or decipher endless dashboards. They need simple visibility and control that works from a browser extension they already know and trust, without another deployment project or six-figure license.
&nbsp;
And while some password management vendors are trying to catch up by&nbsp;acquiring&nbsp;new technologies&nbsp;or rebranding piecemeal add-ons, the result is predictable: a patchwork of disconnected tools, inconsistent interfaces, and separate price tags that make the user experience more complex&mdash;not more secure.
<h2 class="p1" style="color: #0f374e; margin: 0px;">Visibility, control, and peace of mind&nbsp;</h2>
At LastPass, we took a different approach. We built secure access from the ground&nbsp;up,&nbsp; combining&nbsp;visibility, control, and protection in one unified plan that scales seamlessly across departments and clients: Business Max.
&nbsp;
Business Max is our most advanced plan, built to give SMBs and MSPs enterprise-grade access control without&nbsp;the enterprise-grade complexity. It combines everything organizations need to secure today&rsquo;s SaaS-driven workplace in one, cost-effective package:
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Credential Management &ndash; to standardize how employees create, store, and share credentials securely across the business</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">SaaS Monitoring &ndash; to uncover hidden and risky applications employees are using</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">SaaS Protect &ndash; to&nbsp;take action&nbsp;on that visibility by setting usage rules, blocking unapproved tools, and enforcing policies in real time</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Advanced SSO and MFA &ndash; to unify access across every app and login, extending protection beyond passwords</li>
</ul>
<h2 class="p1" style="color: #0f374e; margin: 0px;">Who is Business Max for?</h2>
Business Max was purpose-built for lean IT teams who&nbsp;don&rsquo;t&nbsp;have hours to manage multiple consoles or deploy heavyweight tools. Whether&nbsp;you&rsquo;re&nbsp;securing your own workforce or supporting multiple client environments, it delivers a single,&nbsp;simple way&nbsp;to see, control, and protect every app in use without new agents, extra complexity, or separate licenses.
&nbsp;
And the traction speaks for itself: in just six months,&nbsp;nearly 5,000&nbsp;organizations have&nbsp;purchased&nbsp;or expanded into Business Max. That momentum reflects a growing realization among small and midsized businesses and MSPs alike that secure access&nbsp;doesn&rsquo;t&nbsp;have to be complicated to be powerful.&nbsp;
&nbsp;
&ldquo;Growing demand is developing for tools that address both traditional credential management and emerging risks like shadow IT. LastPass&rsquo;s recent roadmap execution shows meaningful progress in that direction.&rdquo; &mdash; Carlos E. Rivera, Info-Tech Research Group&nbsp;
&nbsp;
And that progress is already being felt in the field, too. SMBs like&nbsp;<a href="https://www.lastpass.com//-/media/4adc006cd69e4863bf1b7919676735ca.pdf">Axxor</a>, a global manufacturer with a lean IT team, are using Business Max to balance innovation and control.&nbsp;
&nbsp;
&ldquo;People are experimenting with AI tools&hellip; We&nbsp;don&rsquo;t&nbsp;want to block innovation, but we do want to guide it safely. LastPass is smart, secure, and it just works.&rdquo; &mdash; Wout&nbsp;Zwiep, Process Engineer,&nbsp;Axxor
<h2 class="p1" style="color: #0f374e; margin: 0px;">New SaaS Protect features released today&nbsp;</h2>
The response to Business Max has made one thing clear: organizations are done with over-engineered security. They want unified visibility and control that work, delivered in a browser extension they already trust. That validation drives us to keep raising the bar&mdash; and today,&nbsp;we&rsquo;re&nbsp;doing just that with our newest release of SaaS Protect. This release includes expanded app visibility, enhanced alerting, and&nbsp;additional&nbsp;customization options to extend and reinforce protection for every&nbsp;team&nbsp;leveraging&nbsp;Business Max.&nbsp;
<h3 class="p1" style="color: #0f374e; margin: 0px;">Key features</h3>
Bird&rsquo;s Eye View of All SaaS Usage Rules: With a new SaaS Protect dashboard, you can now see all applications and usage rules&nbsp;at a glance&nbsp;&mdash; creating a true single-pane-of-glass view of what applications are allowed, restricted, or blocked across your organization.&nbsp;
What this means for admins: a faster, clearer way to assess SaaS risk, enforce policies, and&nbsp;take action, without navigating between dashboards.&nbsp;
<img src="https://www.lastpass.com/-/media/1081e63a1f5948ecba5c799246216463.png" >
Proactive Control with Custom App Additions:&nbsp;You can now add custom or organization-specific applications to the LastPass catalog, enabling you to define usage rules and policies before those apps are even discovered by SaaS Monitoring.
What this means for admins: the ability to take a proactive approach to SaaS access governance &mdash; setting expectations and controls early to prevent risky usage before it starts.
<img src="https://www.lastpass.com/-/media/658a4e2f4f0a42d0ac8d56a493a2f67c.png" >
Smarter Alerts for Credential and Access Risk:&nbsp;New, enhanced alert types automatically detect and flag breached credentials and expired passwords &mdash; helping you strengthen security posture in real time.
What this means for admins: immediate visibility into risky credential behavior, so they can respond quickly, reduce exposure, and&nbsp;maintain&nbsp;compliance without manual investigation.
<img src="https://www.lastpass.com/-/media/5393a1a7b95e48599255594c3fa41dc4.png" >
Clearer Communication with Rule Prompt Previews:&nbsp;Before rolling out new usage rules, you can now preview the exact message employees will see &mdash; and adjust language to improve clarity and reduce confusion.
What this means for admins: smoother rollouts, better user understanding, and higher policy adoption rates &mdash; all without friction or disruption.
<img src="https://www.lastpass.com/-/media/d78d46da7f3344d6aeada34f88d29c5a.png" >
Want&nbsp;to see these features in action? Watch a demo below.
<iframe width="560" height="315" src="https://www.youtube.com/embed/zgWB4ck3Yq4?si=oawPeUilsNpGSl9e" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe>
<h2 class="p5" style="color: #0f374e; margin: 0px 0px 13px;">Secure access that matters right now</h2>
For SMBs and MSPs, the stakes have never been higher. SaaS adoption is surging faster than security teams can keep up, and every unmonitored login widens the attack surface. As Forrester echoes, &ldquo;More than half of IT leaders say SaaS growth is outpacing their ability to secure it&rdquo; &mdash; and the&nbsp;financial impact&nbsp;can be&nbsp;staggering.&nbsp;
Organizations without centralized control over their SaaS environment are five times more likely to experience data loss or a cyber incident, which can cost up to $1 million dollars for SMBs depending on scope and severity. For many organizations,&nbsp;that&rsquo;s&nbsp;not just a&nbsp;setback,&nbsp;it&rsquo;s&nbsp;an existential threat.
That&rsquo;s&nbsp;why Business Max was built with SMBs and MSPs in mind.&nbsp;It&rsquo;s&nbsp;actionable control without enterprise-grade complexity. No new agents or software to install, no long rollouts, and no new systems to learn. You can uncover hidden SaaS apps, set usage rules, and enforce safer access in minutes, not weeks &mdash; turning visibility into action from day one.&nbsp;
Given the current threat landscape, waiting&nbsp;isn&rsquo;t&nbsp;an option; and with LastPass Business Max, you&nbsp;don&rsquo;t&nbsp;have to.
<h3 class="p5" style="color: #0f374e; margin: 0px 0px 13px;">Learn More</h3>
New to Business Max? Check out our webpage to learn more and deep dive into its features:&nbsp;<a href="https://www.lastpass.com/products/business-max">https://www.lastpass.com/products/business-max</a>
<div class="OutlineElement Ltr SCXW265932653 BCX0" style="color: #000000; background-color: #ffffff; margin: 0px; padding: 0px;">
<p class="Paragraph SCXW265932653 BCX0" paraid="1552441698" paraeid="{84b5aea2-1fa0-460b-b82a-e90901488fca}{5}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-left: 0px; padding: 0px;">Sources:
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: #386573; margin: 0px;"><a href="https://www.forrester.com/report/data-overview-technology-landscapes-continue-to-grow-with-saas/RES182400?utm_source=chatgpt.com">https://www.forrester.com/report/data-overview-technology-landscapes-continue-to-grow-with-saas/</a></li>
 <li class="li1" style="color: #386573; margin: 0px;"><a href="https://www.block64.com/blog/the-hidden-costs-of-saas-sprawl-why-its-happening-and-how-bad-its-getting">https://www.block64.com/blog/the-hidden-costs-of-saas-sprawl-why-its-happening-and-how-bad-its-getting</a></li>
 <li class="li1" style="color: #386573; margin: 0px;"><a href="https://bigid.com/blog/a-cost-comparison-of-data-breaches/">https://bigid.com/blog/a-cost-comparison-of-data-breaches/</a></li>
</ul>
</div>
<div class="ListContainerWrapper SCXW265932653 BCX0" style="color: #000000; background-color: #ffffff; margin: 0px; padding: 0px;">
<p aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW265932653 BCX0" style="margin: 0px; padding: 0px;">

</div>
<p aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559683':0,'335559684':-2,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW69013620 BCX0" style="margin: 0px; padding: 0px;">

</div>

LastPass Launches New SaaS Protect Features to Enhance Secure Access Controls Over Unapproved Apps

Business Max is our most advanced plan, built to give SMBs and MSPs enterprise-grade access control without the enterprise-grade complexity.

One chapter in the saga of infostealer malware has ended&mdash;at least for now&mdash;after a global law enforcement takedown of Lumma Stealer in mid-May. US, European, and Japanese authorities, with the help of tech companies including Microsoft and Cloudflare, took down, suspended, and blocked approximately 2,300 malicious domains that made up part of the infostealer&rsquo;s backbone. The FBI also seized domains that served as login panels allowing other criminals to access and use the infostealer. Although, this seizure is intended to effectively prevent criminals from being able to access Lumma to compromise computers and steal data, the overall stealer threat will remain prevalent for the foreseeable future. 
(Interested in learning more about the infostealer threat outlook? Read the LastPass TIME team&rsquo;s threat predictions and analysis on <a href="https://blog.lastpass.com/posts/2025-cybersecurity-trends">what direction infostealers and other threats are heading</a>.) 
<h2>What is Lumma?</h2>
 
Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022. Since its initial release, Lumma&rsquo;s developers have released multiple upgraded versions of the software. Before the malware-as-a-service (MaaS) platform was dismantled, the FBI linked Lumma to around <a href="https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted">10 million infections</a> globally. Lumma&rsquo;s follow-on attacks involving stealing credentials, cryptocurrency data, and credit card information have resulted in an estimated <a href="https://cyberscoop.com/lumma-infostealer-widespread-victims/">$36.5 million USD</a> in credit card theft in 2023. The malware hit individuals and a wide range of industries, including Fortune 500 companies, airlines, universities, banks, and hospitals. 
What makes this stealer particularly effective is that it continues to evolve to bypass security layers even as defenders are responding to the threat. On top of grabbing browser-stored passwords and cookies, it&rsquo;s also capable of extracting autofill data, email credentials, File Transfer Protocol (FTP) data, and two-factor authentication tokens and backup codes. Using its MaaS platform, its creators sold access to the malware on multiple underground markets and platforms like Telegram. 
<h2>What comes next?</h2>
 
This takedown is a major win for law enforcement and will help disrupt the initial access broker ecosystem in the near term. However, this is an ecosystem that has demonstrated its resilience again and again. The number of existing infostealer families, the open access to numerous source codes of previous infostealers, and the constant demand create a lucrative environment with very low barriers to entry. Given the resiliency of this market, other infostealer will likely quickly step in and fill in the gaps left after the Lumma takedown. 
A similar pattern previously played out with other similar takedowns. On October 28, 2024, Operation Magnus disrupted the RedLine and META infostealers. RedLine was a significant stealer last year up until the takedown, after which Lumma grew in popularity and took over a portion of the market share previously held by RedLine. Redline infected 9.9 million hosts, or 43% of all infostealer infections observed by Flashpoint in 2024. The next four most-prolific infostealers in 2024, including RisePro, SteaC, Lumma Stealer, and Meta Stealer, infected a <a href="https://cyberscoop.com/infostealers-cybercrime-surged-2024-flashpoint/">combined 7 million hosts</a>. 
We expect to see something similar following the Lumma Stealer takedown operation. The disruption effect following takedown is real, but there are still some new infections and logs for sale that were likely stolen before the infrastructure was taken down. Additionally, just because Lumma&rsquo;s infrastructure was dismantled, a lot of the data it stole likely continues to live on the dark web&mdash;thanks to the cybercriminal ecosystem that resells this information. Additionally, <a href="https://blog.checkpoint.com/security/lumma-infostealer-down-but-not-out/">CheckPoint</a> reported Lumma&rsquo;s developers are already trying to rebuild and restart their operations, which may or may not be successful.&nbsp;As SpyCloud&rsquo;s <a href="https://www.linkedin.com/posts/thilligoss_lummatakedown-lummareallynowork-stealc-activity-7332888157480198146-u94p">Trevor Hilligoss shared</a>, daily new Lumma infections have trended downward following the takedown but not as much as expected. Continued monitoring will be necessary to determine the takedown&rsquo;s impact. 
Long-standing groups such as Vidar and Stealc are good examples of this, but other newer families, such as Acreed, will also be well positioned to increase their market share. <a href="https://www.bleepingcomputer.com/news/security/russian-market-emerges-as-a-go-to-shop-for-stolen-credentials/">ReliaQuests</a> already reported Acreed is rapidly gaining traction following the Lumma takedown. <a href="https://webz.io/dwp/acreed-infostealer-everything-we-know-so-far/">Over 4,000 logs</a> stolen by Acreed were reportedly uploaded to the Russian Market within its first week of operations.&nbsp;Nexus has also gained some traction over the last week in Lumma&rsquo;s absence. Further, former affiliates and/or administrators associated with Lumma itself may split off to create their own offerings.

<img src="https://cdn.lputil.com/-/media/ffef2d4ef9d544babc2169a6d0274059.jpg?h=310&amp;w=624" >&nbsp;
Daily new LummaC2 infections (Source: Trevor Hilligoss)
<h2>How to protect yourself against infostealers</h2>
The threat from infostealers will remain very real for the foreseeable future and continue to adapt. Oftentimes, stealers are used in indiscriminate campaigns. Additionally, the sheer volume of data that has been dumped on the internet is immense. That means anyone is fair game and should take action to protect themselves following that assumption that they could be targeted. 
<ul>
 <li>Use strong, unique passwords for every account. This will prevent credential stuffing attacks, which is a common tactic where threat actors insert stolen usernames and passwords. That way, if one password is exposed, it won&rsquo;t give access to all your other accounts where you reuse the same password. Also, consider using a password manager to securely and conveniently store them.</li>
 <li>Enable MFA on your accounts. While this measure isn&rsquo;t failproof on its own, it adds an additional layer of defense and makes you a harder target.</li>
 <li>Be on guard for phishing attempts. Infostealers often spread through phishing emails and malicious downloads. </li>
 <li>Check HaveIBeenPwned to monitor potential exposure if you&rsquo;re worried you may have been infected by an infostealer. </li>
</ul>

What the Lumma stealer takedown means for the infostealer market and your personal data

Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkey vs Password: Which is More Secure? | LastPass

Explore the differences between passkeys and passwords. Learn how LastPass enhances security and simplifies access with advanced authentication methods.

Blog

Blog

Recent

News & Insights

Cybersecurity

Product Tutorials

Threat Intel

Product Updates

Tips And Tricks