Klue Supply Chain Incident & LastPass Response

LastPass wants to inform our customers of a security incident which recently occurred at one of our third-party suppliers and how that incident impacts LastPass and our customers.

Get LastPass Free

Create and store secure passwords for yourself, your team or business.

Why LastPass?

Remember fewer passwords and log in faster with our browser extension.

How LastPass works

LastPass zero-knowledge security model keeps your data private even from us.

Security Architecture

Compare LastPass competitors, plans, and features in one place

Compare LastPass

Overview

Password management

Save and autofill

Password generator

Password sharing

Passkeys

Dark web monitoring

Security dashboard

Key Features

Free LastPass Premium trial, no credit card required.

Free LastPass Business trial, no credit card required.

Let our experts help you find the right plan and successfully deploy LastPass.

Sync passwords across all devices, monitor password health, data breaches and much more.

Personal

Premium password management for family or group of 6 people.

Families

Personal Plans

Password vault

Save & autofill

Mobile Smart Scanner

Automatic device sync

Emergency access

Personal password sharing

FOR INDIVIDUALS

30-day free LastPass Premium trial, no credit card required.

30-day free LastPass Families trial, no credit card required.

Limited to 1 device type and basic password management features.

Designed for businesses of all sizes, from small startups to enterprises.

Business

Simplify secure access straight from the browser with more admin control.

Business Max

For single teams just getting started with password management.

Teams

Designed to keep your clients' credentials protected and private.

Business Plans

User management

SaaS Monitoring

SaaS Protect

Secure Access Essentials

Business sharing

Multifactor Authentication

Integrations

Single Sign-on

Identity management

For admins

Marketing teams

Legal teams

HR teams

Business leaders

IT admins

Solutions by role

Case studies

Webinars

Product demos

Events

Trust Center

Compliance Center

Security architecture

LastPass University

Resource Center

Pricing

Join the LastPass Partner Program to provide even more value to your customers.

Partner program overview

Managed Service Providers

Resellers

Cloud marketplaces

Technology Alliance Partners

LastPass Partner Program

Grow new revenue streams by meeting customer's security needs.

Looking for help or interested in becoming a LastPass partner? Get in touch with our partner team.

Connect with trusted LastPass Partners to support your security needs.

Partners

Self-service library of resources and guides for all LastPass products.

Support Center

Community forum

System status

Help

Personal support for all LastPass’ subscribed customers.

Support

Get LastPass free

Submit sales inquiry

Chat with sales

Request a demo

Find a partner

Contact sales

Log in

10 Best CASB Tools for 2026: Compare Top Solutions for Lean IT Teams & Enterprises

Compare the 10 best CASB tools for visibility, access control, compliance, and shadow IT management. See which solutions work best for lean IT teams and enterprises.

10 of the best CASB tools (including an option for small to midsize businesses)

Your Practical AI Governance Compliance Guide: Mapping Access Controls to SOC 2, HIPAA, GDPR, ISO 27001, & More

<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="1" data-aria-level="1">An AI acceptable use policy&nbsp;alone&nbsp;isn&rsquo;t&nbsp;enough. Auditors&nbsp;expect&nbsp;controls&nbsp;to&nbsp;be&nbsp;enforced&nbsp;in real time.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="2" data-aria-level="1">Five core&nbsp;controls&nbsp;can help you prove&nbsp;AI governance,&nbsp;even without a dedicated security team:&nbsp;Discovery,&nbsp;Classification,&nbsp;Authentication,&nbsp;Governance, and&nbsp;Auditability.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="3" data-aria-level="1">Frameworks like SOC 2, HIPAA, GDPR, ISO 27001, ISO 42001, NIST AI RMF, and the EU AI Act all&nbsp;require&nbsp;some form of&nbsp;access&nbsp;governance evidence.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="4" data-aria-level="1">The biggest blind spots for&nbsp;small to mid-sized teams&nbsp;are personal AI accounts and shared credentials, which undermine user attribution.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="5" data-aria-level="1">If&nbsp;you've&nbsp;just begun discussions on&nbsp;governing&nbsp;AI access, start with&nbsp;this guide:&nbsp;<a href="https://blog.lastpass.com/posts/allow-warn-block-ai-governance-model">Allow, Warn, Block: A&nbsp;Practical AI Governance Model for Lean&nbsp;Teams</a>.&nbsp;Then,&nbsp;return&nbsp;to this article&nbsp;to build&nbsp;controls that&nbsp;pass&nbsp;auditor scrutiny.&nbsp;</li>
</ul>

TL; DR AI Governance Compliance for Lean IT Teams 

AI governance controls for growing IT teams

Prove AI governance compliance with 5 access controls auditors expect. Learn how discovery, access controls, and SaaS monitoring support compliance.

   How Do You Prove AI Governance Compliance? 5 Access Controls Auditors Expect to See 

Top Cyber Threats of 2026: Insights from LastPass Phish Bowl Live

Explore the latest threat intelligence from LastPass experts in their live webinar session, covering AI-powered attacks, credential theft, phishing trends, infostealers, and practical security recommendations for businesses.

The Phish Bowl: AI, Identity, and Emerging Threats — Webinar recap & resource guide

LastPass Threat Intelligence, Mitigation, and Escalation (TIME) would like to alert our customers to an active phishing campaign identified on July 13, 2026. Phishing emails are being sent from hello@lastpassnewsletter.com with the subject line shown below, directing recipients to a fraudulent site likely designed to steal LastPass master passwords.
This is likely an attempt on the part of a threat actor to generate urgency and trick customers into handing over their credentials, which is a common social engineering tactic. LastPass systems are not affected.
&nbsp;
Campaign Overview
The attacker registered two lookalike domains, lastpassnewsletter[.]com and lastpasscompliance[.]com, neither of which is affiliated with LastPass in any way. Emails sent from hello@lastpassnewsletter.com are designed to look like an official LastPass security notice, instructing recipients to review updated security policies via a provided link.
<img src="https://www.lastpass.com/-/media/cf0007801c574119b9244b76379cdc95.png?h=852&amp;w=607" >
Image: Example of a phishing email sent from hello@lastpassnewsletter[.]com. 
Clicking the link directs recipients to https[:]//lastpasscompliance[.]com/, a site impersonating a third-party service and prompting visitors to download software. The site has been confirmed malicious by Microsoft Defender for Office 365 and Cloudflare. We are investigating the nature of the download and will update this post as findings are confirmed.
<img src="https://www.lastpass.com/-/media/1e8ea3f5317342f5b81d3e8de40db493.png?h=729&amp;w=1383" >
Image: The phishing link redirects targets to a landing page that impersonates DocuSign. 
The phishing site has been independently classified as malicious by Microsoft Defender for Office 365, which blocks the URL via SafeLinks, and by Cloudflare, which is currently serving a "Suspected Phishing" warning to anyone who navigates to the domain. 
We are working with our partners to have these domains taken down as quickly as possible.
Known Sender and Subject Line
From:
hello@lastpassnewsletter.com
Subject:
Action Required: Review Updated LastPass Security Policies
What to Do
Please remember that no one at LastPass will ever ask for your master password.
If you received this email:
<ul style="margin-top: 0in; list-style-type: disc;">
 <li>Do not click any links in the message.</li>
 <li>Do not enter your credentials on any site you reached from this email.</li>
 <li>If you did enter your master password on the phishing site, change it immediately from a trusted device at <a href="https://www.lastpass.com/">LastPass.com</a> and review your vault for any unexpected activity.</li>
</ul>
As always, if you are ever unsure whether a LastPass-branded email is legitimate, please submit it to abuse@lastpass.com. We would like to thank the customers who have already flagged this campaign for their vigilance.
&nbsp;
<h2>Indicators of Compromise</h2>
Malicious domains at time of publication:
<ul>
 <li>lastpasscompliance[.]com &mdash; phishing site impersonating a LastPass account portal
 <ul>
 <li>Serving IP: 34.132.187.133 (Google Cloud Platform)</li>
 </ul>
 </li>
 <li>lastpassnewsletter[.]com &mdash; fraudulent sending domain used to deliver phishing emails
 <ul>
 <li>Sending IP: 54.240.9.8 (Amazon SES)</li>
 </ul>
 </li>
</ul>
Sender address:
<ul>
 <li>hello@lastpassnewsletter[.]com</li>
</ul>
Subject line:
<ul>
 <li>Action Required: Review Updated LastPass Security Policies</li>
</ul>
SHA256 artifact hash:
<ul>
 <li>8ae49ed3cb1e076fd12eb1f5489f1be0c9be4264731b3afd4175cf3284bc1b79 
 <div>&nbsp;</div>
 </li>
</ul>
This post will be updated as new information becomes available. For questions or to report a suspicious email, contact <a href="mailto:abuse@lastpass.com">abuse@lastpass.com</a>.

LastPass Threat Intelligence, Mitigation, and Escalation (TIME) would like to alert our customers to an active phishing campaign identified on July 13, 2026. LastPass systems are not affected.

LastPass alerts customers to active phishing campaign using lookalike domains; no impact to LastPass systems

June 22, 2026, Five Eyes AI Warning: What Boards and CISOs Must Do Now

<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="1" data-aria-level="1">On June 22, 2026, the Five Eyes alliance&nbsp;warned&nbsp;that AI is&nbsp;accelerating cyber threats&nbsp;and&nbsp;organisations&nbsp;have months, not years,&nbsp;to&nbsp;act.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="2" data-aria-level="1">Because attackers are&nbsp;increasingly&nbsp;leveraging&nbsp;AI to target&nbsp;identities&nbsp;&amp;&nbsp;credentials, the alliance&nbsp;now views&nbsp;access control as a governance issue, requiring board-level oversight.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="3" data-aria-level="1">Boards should expect evidence, not claims, that access controls will hold under AI-accelerated conditions.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:720,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:279,&quot;335559991&quot;:360}">&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="4" data-aria-level="1">In the next&nbsp;90 days, boards should&nbsp;assess visibility into SaaS &amp; AI usage,&nbsp;validate&nbsp;access controls, and&nbsp;establish reporting that&nbsp;demonstrates&nbsp;controls are&nbsp;working&nbsp;effectively.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:720,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:279,&quot;335559991&quot;:360}">&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="5" data-aria-level="1">LastPass gives&nbsp;your team&nbsp;AI app&nbsp;discovery, authentication&nbsp;controls, and audit-ready access logs to&nbsp;align with the Five Eyes advisory.&nbsp;</li>
</ul>

60-second board brief: What leadership needs to know

What the Five Eyes AI warning means for boards, CEOs, and security leadership

The Five Eyes alliance warns AI is accelerating cyber risk and supercharging credential-based attacks. Learn what CISOs and executives must do now.

Matthew McWhirter

Vice President, Asia Pacific, LastPass

What the June 22, 2026, Five Eyes AI Warning Means for Boards, CEOs, and Security Leadership

Black Hat USA 2026 Las Vegas: Key trends, sessions, and takeaways

<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="1" data-aria-level="1">Black Hat USA 2026 will be held at the Mandalay Bay Convention Center in Las Vegas, Nevada, from August 1&ndash;6, 2026 (Trainings: Aug 1&ndash;4; Briefings: Aug 5&ndash;6; Business Hall Aug 4-6).&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="2" data-aria-level="1">This year's most-talked-about&nbsp;Briefings&nbsp;topics&nbsp;include&nbsp;AI offense &amp; defense,&nbsp;supply chain&nbsp;security,&nbsp;and&nbsp;AI-driven exploitation of vulnerabilities in&nbsp;hardware &amp; embedded systems.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="3" data-aria-level="1">Registration options range from&nbsp;Briefings-only passes to full&nbsp;Training tracks with professional certifications.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="4" data-aria-level="1">Yes, LastPass will be at Black Hat USA 2026. Scroll down to find out where to meet us and what we&nbsp;have in store for you.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="5" data-aria-level="1">Don't&nbsp;skip the FAQ section.&nbsp;There's&nbsp;an honest answer to the question&nbsp;your finance team may be asking:&nbsp;Is this conference&nbsp;actually worth&nbsp;the budget?&nbsp;</li>
</ul>

What to Know Before You Read

Black Hat USA 2026

Everything you need for Black Hat USA 2026: Schedule, sessions, pricing, and the top cybersecurity trends shaping modern defense

Your Complete Guide to Black Hat USA 2026, Las Vegas: Where Research Meets Real-World Defense

A Guide to Shadow IT Management for Small to Midsize Businesses

FAQs: Shadow IT Management

A guide for business owners on shadow IT management, SaaS sprawl, and credential management.

Are Your AI Tools Putting Attorney-Client Privilege at Risk?

<ul>
<li data-leveltext="" data-font="Symbol" data-listid="4" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="1" data-aria-level="1">AI agents can&nbsp;reuse&nbsp;context across&nbsp;client boundaries&nbsp;if not explicitly scoped,&nbsp;creating exposure that&nbsp;traditional&nbsp;&ldquo;ethical walls&rdquo;&nbsp;don&rsquo;t&nbsp;cover.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="4" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="2" data-aria-level="1">When client data passes through a third-party&nbsp;platform&nbsp;as part of an agentic workflow,&nbsp;firms may face arguments&nbsp;that&nbsp;attorney-client privilege has&nbsp;been weakened or&nbsp;waived, even if no disclosure was intended.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="4" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="3" data-aria-level="1">Courts have already&nbsp;sanctioned attorneys for&nbsp;submitting&nbsp;unverified&nbsp;AI-generated citations, signaling&nbsp;tightening expectations around AI oversight&nbsp;(Mata vs. Avianca).&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="4" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="4" data-aria-level="1">As&nbsp;agentic AI usage grows, firms bear increasing responsibility to&nbsp;demonstrate&nbsp;oversight, auditability, and reasonable care.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="4" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="5" data-aria-level="1">If you&nbsp;don&rsquo;t&nbsp;know which tools your attorneys are&nbsp;authenticating into, you lack both visibility and control over where client data can flow.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="4" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="6" data-aria-level="1">Enterprise AI governance&nbsp;doesn&rsquo;t&nbsp;begin with tracking&nbsp;downstream AI actions&nbsp;but&nbsp;controlling and documenting&nbsp;where access is granted.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="4" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="7" data-aria-level="1">Every downstream risk starts with a login. LastPass operates&nbsp;as a top-layer governance&nbsp;control,&nbsp;giving you&nbsp;visibility into every SaaS&nbsp;and AI&nbsp;tool&nbsp;your&nbsp;attorneys are&nbsp;logging&nbsp;in&nbsp;to.&nbsp;With LastPass,&nbsp;you have a defensible record of how AI tools entered your environment and who has&nbsp;the ability to use them.&nbsp;</li>
</ul>

Most firms have AI policies but few can defend them. Explore why agentic AI breaks traditional safeguards and what “reasonable care” really requires today.

Client Confidentiality in the Age of AI Agents: A New Duty of Care

10 controls to validate before you deploy agentic AI

<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="50" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1">"An agent is equivalent to a newly hired employee. It needs a unique identity,&nbsp;least&nbsp;privilege&nbsp;access, and monitoring to watch what it's doing."&nbsp;~&nbsp;Rafay Baloch, CEO, REDSECLABS</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="50" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1">"The attack surface most organizations are unprepared to defend is&nbsp;the&nbsp;one where agents&nbsp;are still&nbsp;making&nbsp;API calls after the developer who built them left the company."&nbsp;~&nbsp;Roey Eliyahu, CEO, Salt Security</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="50" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1">"The higher the business impact and the harder it is to reverse an action, the more human oversight should be required."&nbsp;~&nbsp;Sherif Koussa, CEO, Software Secured</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="50" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="4" data-aria-level="1">"The model is your reasoning layer. The APIs it connects to are your action layer. Most organizations&nbsp;focus&nbsp;on locking down reasoning&nbsp;while leaving&nbsp;the action layer wide open."&nbsp;~&nbsp;Michael Callahan, VP of Cyber Strategy, Salt Security</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="50" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="5" data-aria-level="1">"Before deploying any agent into production, you need a complete trail showing inputs, outputs, decisions, tool usage, and user approvals."&nbsp;~&nbsp;Deepak Shukla, CEO, Pearl Lemon AI</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="50" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="6" data-aria-level="1">Most SMBs discover unauthorized AI tool usage after it has already become a liability. LastPass surfaces&nbsp;every&nbsp;AI tool your team is accessing&nbsp;in the browser,&nbsp;without infrastructure changes or a security team.</li>
</ul>

What security experts and business leaders say about agentic AI risk

FAQs: 2026 Agentic AI security checklist

Attention business owners: Get your 2026 agentic AI security checklist right now 

Your 2026 Agentic AI Security Checklist: 10 Controls to Validate Before You Deploy 

<div id="calloutcontent1">&nbsp;</div>
Secure access starts with a simple truth: You can't protect what you can't access securely.
And for most people, the first step of getting passwords into a secure vault is where momentum breaks down.
Before Zero Trust, autofill, or Dark Web Monitoring can keep you safe, there's one foundational step everything depends on: capturing and securing every login.
Getting this first step right sets the stage for secure access.
That's why <a href="https://blog.lastpass.com/posts/secure-access-essentials">Secure Access Essentials</a> begins with something simple: removing friction from how you enter passwords into your vault.
As a first in the password management space, we're introducing Mobile Smart Scanner to remove that friction.
<h2>The one change that makes every login in your life easier</h2>
In 2026, the work-life boundary has shifted.
Work follows you everywhere.
You're switching between devices and logging into dozens of accounts daily.
At the same time, your passwords are stored in too many places. And you're reusing them across sites because it's easier.
Unfortunately, that also makes account takeovers far more likely.
As the threats rise, secure access is no longer optional &mdash; it's essential. That means simplifying the way your passwords move from paper to secure vault isn't just about convenience.
When you can quickly get your credentials organized, security feels intuitive and less like a chore. This one simple shift keeps you safer.
Innovation in security matters. Instead of asking you to change how you live, we focused on making security work the way you live, so it stops being something you avoid and starts being something that just works for you.
<h2>Introducing LastPass Mobile Smart Scanner: Password management that works the way you do</h2>
Mobile Smart Scanner is an intelligent password scanner that's available only in LastPass.
Built directly into the LastPass mobile app, Smart Scanner lets you use your phone's camera to scan typed or handwritten passwords and turn them into ready-to-use password vault entries.

<img src="https://www.lastpass.com/-/media/6f2c7e5075444f1cbded0bd55aacac0f.png?h=560&amp;w=500" >&nbsp;

Simply:
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1">Open your LastPass mobile&nbsp;app.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1">Scan&nbsp;the&nbsp;credentials.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1">Review&nbsp;detected fields such as&nbsp;site, username, and&nbsp;password.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="4" data-aria-level="1">Save&nbsp;to&nbsp;your&nbsp;vault.</li>
</ul>
The credentials you save&nbsp;with Smart Scanner&nbsp;are&nbsp;fully&nbsp;functional&nbsp;entries&nbsp;that&nbsp;can&nbsp;be&nbsp;auto filled&nbsp;like&nbsp;your other stored&nbsp;credentials.
This means&nbsp;no more delays, errors, or&nbsp;missed&nbsp;accounts.
And since we know secure access requires trust, Smart Scanner works entirely on your device, so your scans stay private. Credentials and images aren't stored or sent to LastPass, and you stay fully in control at every step. The result is a seamless experience that prioritizes ease and trust.
<h2>Why Mobile Smart Scanner matters for your business</h2>
For organizations, the biggest challenge with&nbsp;Secure Access&nbsp;is adoption.
Mobile Smart Scanner addresses this by removing the friction that prevents&nbsp;your&nbsp;employees from getting started.
<h3>Built for trust, designed for ease</h3>
Employees often store credentials in&nbsp;apps, spreadsheets, or even on paper. Smart Scanner&nbsp;makes it fast and easy to migrate&nbsp;those credentials into an&nbsp;encrypted&nbsp;vault.
<h3>Reduced&nbsp;IT burden</h3>
By simplifying credential&nbsp;management,&nbsp;you&nbsp;can reduce password reset requests. Smart Scanner makes secure behavior the easiest behavior,&nbsp;so&nbsp;your IT team&nbsp;can focus on&nbsp;mission-critical tasks.&nbsp;
<h3>Stronger&nbsp;Zero Trust foundation</h3>
In a Zero Trust approach, visibility is everything. Smart Scanner&nbsp;ensures&nbsp;every login is captured and secured.
<h3>Built for how people&nbsp;actually work</h3>
Smart Scanner was designed to meet users where they are,&nbsp;whether that&rsquo;s handwritten notes&nbsp;or&nbsp;printed documents.
Whether&nbsp;you&rsquo;re&nbsp;new to LastPass or finally bringing every password into one place, Mobile Smart Scanner helps you spend less time setting up&nbsp;and more time enjoying&nbsp;secure&nbsp;access to your digital life.
<h2>Simplify security without compromise</h2>
Mobile Smart Scanner is&nbsp;now&nbsp;currently available to all customers, including business users.
This means&nbsp;your business will be able to equip teams with a faster, more intuitive way to adopt&nbsp;secure&nbsp;access&nbsp;from&nbsp;day&nbsp;one.
So, go ahead.&nbsp;Scan. Save. Secure.&nbsp;Mobile Smart Scanner removes one of the last barriers to&nbsp;secure&nbsp;access, so every credential is protected from the very start.
<a rel="noopener noreferrer" href="https://blog.lastpass.com/posts/secure-access-essentials" target="_blank"><button class="lp-button lp-button--primary">Learn more about Secure Access Essentials</button></a>

LastPass Mobile Smart Scanner: Secure Access Made Simple

<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1">Mobile Smart Scanner&nbsp;is an intelligent password scanner that&nbsp;removes the biggest barrier to&nbsp;using password managers: Getting credentials into a secure vault.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1">Mobile Smart Scanner is now generally available to all customers, including business users.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1">This new capability&nbsp;is designed to&nbsp;improve employee adoption&nbsp;and accelerate time-to-value.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="4" data-aria-level="1">Mobile Smart Scanner is exclusive to LastPass,&nbsp;giving you the ability to scan&nbsp;credentials&nbsp;into fully usable, autofill-ready vault entries instantly.</li>
</ul>

Key takeaways: Mobile Smart Scanner

Capturing passwords just got easier. LastPass Mobile Smart Scanner lets you scan credentials with your phone's camera and save them directly to your vault.

Removing the First Barrier to Secure Access: LastPass Mobile Smart Scanner

One chapter in the saga of infostealer malware has ended&mdash;at least for now&mdash;after a global law enforcement takedown of Lumma Stealer in mid-May. US, European, and Japanese authorities, with the help of tech companies including Microsoft and Cloudflare, took down, suspended, and blocked approximately 2,300 malicious domains that made up part of the infostealer&rsquo;s backbone. The FBI also seized domains that served as login panels allowing other criminals to access and use the infostealer. Although, this seizure is intended to effectively prevent criminals from being able to access Lumma to compromise computers and steal data, the overall stealer threat will remain prevalent for the foreseeable future. 
(Interested in learning more about the infostealer threat outlook? Read the LastPass TIME team&rsquo;s threat predictions and analysis on <a href="https://blog.lastpass.com/posts/2025-cybersecurity-trends">what direction infostealers and other threats are heading</a>.) 
<h2>What is Lumma?</h2>
 
Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022. Since its initial release, Lumma&rsquo;s developers have released multiple upgraded versions of the software. Before the malware-as-a-service (MaaS) platform was dismantled, the FBI linked Lumma to around <a href="https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted">10 million infections</a> globally. Lumma&rsquo;s follow-on attacks involving stealing credentials, cryptocurrency data, and credit card information have resulted in an estimated <a href="https://cyberscoop.com/lumma-infostealer-widespread-victims/">$36.5 million USD</a> in credit card theft in 2023. The malware hit individuals and a wide range of industries, including Fortune 500 companies, airlines, universities, banks, and hospitals. 
What makes this stealer particularly effective is that it continues to evolve to bypass security layers even as defenders are responding to the threat. On top of grabbing browser-stored passwords and cookies, it&rsquo;s also capable of extracting autofill data, email credentials, File Transfer Protocol (FTP) data, and two-factor authentication tokens and backup codes. Using its MaaS platform, its creators sold access to the malware on multiple underground markets and platforms like Telegram. 
<h2>What comes next?</h2>
 
This takedown is a major win for law enforcement and will help disrupt the initial access broker ecosystem in the near term. However, this is an ecosystem that has demonstrated its resilience again and again. The number of existing infostealer families, the open access to numerous source codes of previous infostealers, and the constant demand create a lucrative environment with very low barriers to entry. Given the resiliency of this market, other infostealer will likely quickly step in and fill in the gaps left after the Lumma takedown. 
A similar pattern previously played out with other similar takedowns. On October 28, 2024, Operation Magnus disrupted the RedLine and META infostealers. RedLine was a significant stealer last year up until the takedown, after which Lumma grew in popularity and took over a portion of the market share previously held by RedLine. Redline infected 9.9 million hosts, or 43% of all infostealer infections observed by Flashpoint in 2024. The next four most-prolific infostealers in 2024, including RisePro, SteaC, Lumma Stealer, and Meta Stealer, infected a <a href="https://cyberscoop.com/infostealers-cybercrime-surged-2024-flashpoint/">combined 7 million hosts</a>. 
We expect to see something similar following the Lumma Stealer takedown operation. The disruption effect following takedown is real, but there are still some new infections and logs for sale that were likely stolen before the infrastructure was taken down. Additionally, just because Lumma&rsquo;s infrastructure was dismantled, a lot of the data it stole likely continues to live on the dark web&mdash;thanks to the cybercriminal ecosystem that resells this information. Additionally, <a href="https://blog.checkpoint.com/security/lumma-infostealer-down-but-not-out/">CheckPoint</a> reported Lumma&rsquo;s developers are already trying to rebuild and restart their operations, which may or may not be successful.&nbsp;As SpyCloud&rsquo;s <a href="https://www.linkedin.com/posts/thilligoss_lummatakedown-lummareallynowork-stealc-activity-7332888157480198146-u94p">Trevor Hilligoss shared</a>, daily new Lumma infections have trended downward following the takedown but not as much as expected. Continued monitoring will be necessary to determine the takedown&rsquo;s impact. 
Long-standing groups such as Vidar and Stealc are good examples of this, but other newer families, such as Acreed, will also be well positioned to increase their market share. <a href="https://www.bleepingcomputer.com/news/security/russian-market-emerges-as-a-go-to-shop-for-stolen-credentials/">ReliaQuests</a> already reported Acreed is rapidly gaining traction following the Lumma takedown. <a href="https://webz.io/dwp/acreed-infostealer-everything-we-know-so-far/">Over 4,000 logs</a> stolen by Acreed were reportedly uploaded to the Russian Market within its first week of operations.&nbsp;Nexus has also gained some traction over the last week in Lumma&rsquo;s absence. Further, former affiliates and/or administrators associated with Lumma itself may split off to create their own offerings.

<img src="https://static.lputil.com/-/media/ffef2d4ef9d544babc2169a6d0274059.jpg?h=310&amp;w=624" >&nbsp;
Daily new LummaC2 infections (Source: Trevor Hilligoss)
<h2>How to protect yourself against infostealers</h2>
The threat from infostealers will remain very real for the foreseeable future and continue to adapt. Oftentimes, stealers are used in indiscriminate campaigns. Additionally, the sheer volume of data that has been dumped on the internet is immense. That means anyone is fair game and should take action to protect themselves following that assumption that they could be targeted. 
<ul>
 <li>Use strong, unique passwords for every account. This will prevent credential stuffing attacks, which is a common tactic where threat actors insert stolen usernames and passwords. That way, if one password is exposed, it won&rsquo;t give access to all your other accounts where you reuse the same password. Also, consider using a password manager to securely and conveniently store them.</li>
 <li>Enable MFA on your accounts. While this measure isn&rsquo;t failproof on its own, it adds an additional layer of defense and makes you a harder target.</li>
 <li>Be on guard for phishing attempts. Infostealers often spread through phishing emails and malicious downloads. </li>
 <li>Check HaveIBeenPwned to monitor potential exposure if you&rsquo;re worried you may have been infected by an infostealer. </li>
</ul>

What the Lumma stealer takedown means for the infostealer market and your personal data

Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkey vs Password: Which is More Secure? | LastPass

FAQs: Passkey vs password

Explore the differences between passkeys and passwords. Learn how LastPass enhances security and simplifies access with advanced authentication methods.

Blog

Blog

Recent

News & Insights

Cybersecurity

Product Tutorials

Threat Intel

Product Updates

Tips And Tricks

Klue Supply Chain Incident & LastPass Response

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkeys Vs. Passwords: Which Login Method Is Safer in 2026?

10 of the best CASB tools (including an option for small to midsize businesses)

How Do You Prove AI Governance Compliance? 5 Access Controls Auditors Expect to See

Subscribe & Save 20% off Premium or Families plans

The Phish Bowl: AI, Identity, and Emerging Threats — Webinar recap & resource guide

LastPass alerts customers to active phishing campaign using lookalike domains; no impact to LastPass systems

What the June 22, 2026, Five Eyes AI Warning Means for Boards, CEOs, and Security Leadership

Your Complete Guide to Black Hat USA 2026, Las Vegas: Where Research Meets Real-World Defense

A Guide to Shadow IT Management for Small to Midsize Businesses

Client Confidentiality in the Age of AI Agents: A New Duty of Care

Klue Supply Chain Incident & LastPass Response

Your 2026 Agentic AI Security Checklist: 10 Controls to Validate Before You Deploy

Removing the First Barrier to Secure Access: LastPass Mobile Smart Scanner