You might have seen <a href="https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024">this shocking prediction from Gartner:</a> by 2027, 75% of employees will acquire, modify or create technology outside IT&rsquo;s visibility &ndash; up from 41% in 2022.&nbsp;
Your employees rely on more SaaS tools than ever and not all of them are on your radar. &nbsp; 
From cloud apps and browser extensions to AI tools, today&rsquo;s workplaces move fast. And when anyone can implement a new app with little more than a credit card and a dream, you can be sure that very few of them are thinking about access or credential management. Consider this:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Shadow IT and Shadow AI are expanding the attack surface, with unsanctioned tools introducing security gaps no one&rsquo;s monitoring.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">App bloat is costing real money &mdash; small businesses now pay for an average of 134 unused applications, and large organizations pay for 473.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Sensitive data is slipping through the cracks, with 38% of employees admitting they&rsquo;ve shared work information with unauthorized AI tools.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Compliance is harder to maintain when there&rsquo;s no clear picture of who&rsquo;s accessing what, and from where.&nbsp;</li>
</ul>
Single sign-on (SSO) can help with your core apps-- the ones that you know about-- but it doesn&rsquo;t cover everything, especially those smaller, hidden apps. And for small and mid-sized businesses, controlling those can get expensive and time-consuming, fast.&nbsp;&nbsp;
That&rsquo;s where the security gaps start. Without a simple, customizable way to manage access, secure credentials and monitor app usage, it&rsquo;s easy to lose control. And that opens the door to risk from old accounts that still have access to sensitive info, to apps no one remembers signing up for.&nbsp;
It&rsquo;s no longer enough to secure passwords alone. Businesses need an approach to identity and access management that&rsquo;s as flexible, efficient, and user-friendly as the tools their employees actually use.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">What is Secure Access Experiences?&nbsp;&nbsp;</h2>
Secure Access Experiences is the LastPass answer to this growing access management crisis &mdash; an evolving approach designed to bring together essential capabilities into one intuitive experience. It helps you control who has access to what, based on your own policies &mdash; not just passwords. Whether your team is using approved tools or ones you didn&rsquo;t even know about, you&rsquo;ll get the visibility and control you need, all in one easy-to-use solution.&nbsp;
With Secure Access Experiences, you will be able to:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Log in with ease: Securely manage how your team stores and uses passwords. Support for passkeys makes logging in even faster and safer.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Control who gets access: Make sure the right people have access to the right apps, systems, and data&mdash;nothing more, nothing less. It&rsquo;s easy to set up and adjust as your business grows.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">See what&rsquo;s happening: Know which apps your team is using, when, and how. Stay informed, spot issues early, and feel confident that everything&rsquo;s running smoothly.&nbsp;&nbsp;&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Why do Secure Access Experiences matter?&nbsp;</h2>
As SaaS adoption grows and the lines between personal and professional tools blur, businesses need a smarter, simpler way to manage access &mdash; one that meets modern challenges head-on, without overwhelming teams or breaking the bank.&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Grows with your business: As your business adds more tools, people, and locations, LastPass makes it easy to keep everything secure without slowing you down.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Easy to manage, easier on your budget: Control access to all your tools from one place. Less hassle for you, and no need to invest in multiple systems.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Provides better protection, fewer headaches: Keep your business safe with strong, simple security&mdash;and make it easier to meet industry requirements along the way.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Simple for your team to use: When it&rsquo;s easy to use, your team actually uses it. That means stronger habits, less risk, and happier employees.&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">It starts with SaaS Monitoring.&nbsp;</h2>
You can&rsquo;t control what you can&rsquo;t see. That&rsquo;s why the first capability in Secure Access Experiences is SaaS Monitoring &mdash; expected in mid-May and delivered via the same browser extension already trusted by millions for password management.&nbsp;&nbsp;
<img src="https://cdn.lputil.com/-/media/2b6fd9bba92346a8a0fcedeca39eed06.png?h=824&amp;w=1250" >
<p class="Paragraph SCXW34306727 BCX0" paraid="543943140" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{232}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">With SaaS Monitoring, business owners and IT admins can finally see what apps are being used across their organization, helping them detect unapproved tools, spot Shadow IT and Shadow AI, and optimize application investments &mdash; all without the need to deploy extra agents, integrations or complexity.
<p class="Paragraph SCXW34306727 BCX0" paraid="713470910" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{238}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">Want to see the future of easier visibility and control? If you&rsquo;re attending RSA, stop by Booth 1449 in the South Expo at RSAC 2025 to see SaaS Monitoring in action. Get hands-on with live demos, hear from our experts, and see what&rsquo;s next for Secure Access Experiences with LastPass.
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>

Introducing Secure Access Experiences: Controlling the Chaos of Modern App Sprawl

Secure Access Experiences is the LastPass answer to this growing access management crisis.

Get LastPass Free

Create and store secure passwords for yourself, your team or business.

Why LastPass?

Remember fewer passwords and log in faster with our browser extension.

How LastPass works

LastPass zero-knowledge security model keeps your data private even from us.

Security Architecture

Compare LastPass competitors, plans, and features in one place

Compare LastPass

Overview

Password management

Save and autofill

Password generator

Password sharing

Dark web monitoring

Security dashboard

SaaS Monitoring

Key Features

Free LastPass Premium trial, no credit card required.

Free LastPass Business trial, no credit card required.

Let our experts help you find the right plan and successfully deploy LastPass.

Sync passwords across all devices, monitor password health, data breaches and much more.

Personal

Premium password management for family or group of 6 people.

Families

Personal Plans

30-day free LastPass Premium trial, no credit card required.

30-day free LastPass Families trial, no credit card required.

Limited to 1 device type and basic password management features

Designed for businesses of all sizes, from small startups to enterprises.

Business

Gain complete visibility into your organization’s entire SaaS footprint.

Business Max

For single teams just getting started with password management.

Teams

Designed to keep your clients' credentials protected and private

Business Plans

User management

Business sharing

Multifactor authentication

Integrations

Single sign-on

Identity management

For admins

Case Studies

Webinars

Product demos

Solutions by roles

Blog

Trust Center

Compliance Center

LastPass University

Resources & Solutions

Pricing

Join the LastPass Partner Program to provide even more value to your customers.

Partner program overview

Managed Service Providers

Resellers

Cloud marketplaces

Technology Alliance Partners

LastPass Partner Program

Grow new revenue streams by meeting customer's security needs.

Looking for help or interested in becoming a LastPass partner? Get in touch with our partner team.

Connect with trusted LastPass Partners to support your security needs.

Partners

Self-service library of resources and guides for all LastPass products.

Support Center

Community forum

System status

Help

Personal support for all LastPass’ subscribed customers.

Support

Get LastPass free

Chat with sales

Call sales

Email sales

Request a demo

Find a partner

Contact sales

Log in

The May 21 announcement of a law enforcement operation in conjunction with Microsoft targeting LummaC2 that resulted in the seizure of over 2,300 malicious domains was rightly celebrated as a major victory against the ongoing scourge of infostealers, a family of malware that has risen to prominence over the last few years for both its ubiquity and its central role in numerous major breaches. This disruption of the infostealer ecosystem led to the rise of a new infostealer,&nbsp;Acreed.1&nbsp;While the rumors of LummaC2&rsquo;s demise turned out to be a bit exaggerated (as highlighted in&nbsp;<a class="Hyperlink SCXW193238760 BCX0" href="https://www.trendmicro.com/en_us/research/25/g/lumma-stealer-returns.html" target="_blank" rel="noopener noreferrer" style="color: inherit; margin: 0px; padding: 0px;">this recent excellent report from TrendMicro),</a>Acreed&nbsp;has&nbsp;maintained&nbsp;a foothold within the infostealer market while&nbsp;remainingrelatively elusive&nbsp;for defenders.&nbsp;Let&rsquo;s&nbsp;take a closer look at what we know about&nbsp;Acreed.&nbsp;
Acreed&nbsp;began offering credentials for sale in the dark web marketplace, Russian Market, in mid-February of this year. Since its introduction, only one account on Russian Market has offered stolen credentials associated with&nbsp;Acreed&nbsp;for sale. The account, which is anonymized to some degree as all accounts are on Russian Market,&nbsp;leverages&nbsp;the username &ldquo;Nu####ez.&rdquo; This threat actor has been posting logs on Russian Market since at least early 2024 and had previously been associated&nbsp;largely with&nbsp;the sale logs associated with LummaC2. However, earlier this year, Nu####ez began offering logs stolen via the new&nbsp;Acreed&nbsp;stealer. While postings were initially erratic, Nu####ez began posting more&nbsp;Acreed&nbsp;logs regularly beginning in early May. A few weeks later, law enforcement conducted the LummaC2 takedown operation, leading to a sharp increase in&nbsp;Acreed&rsquo;s&nbsp;percentage share in logs posted on Russian Market. Some of this reflected the quick drop in available logs due to the LummaC2 disruption, but there was&nbsp;a commensurate&nbsp;increase in available&nbsp;Acreed&nbsp;logs as well.&nbsp;
Interestingly,&nbsp;Acreed&nbsp;does not seem to be available for sale like LummaC2 or other infostealers-as-a-service, nor were we, in conjunction with our friends at Flashpoint, able to find any samples in the wild. As such,&nbsp;it appears the malware&nbsp;is used in a limited fashion, though indications from the log files provide enough data to support the hypothesis that&nbsp;Acreed&nbsp;is indeed its own infostealer and not a simple renaming of logs stolen with another malware. As Flashpoint found,&nbsp;Acreed&nbsp;uses a unique directory and file naming convention that could be used to potentially&nbsp;identify&nbsp;samples in the wild or during runtime (see below).&nbsp;
<img src="https://www.lastpass.com/-/media/6ab586f36c38433499f239eff3823d8e.png?h=211&amp;w=621" >
Acreed stealer log files (Source: Flashpoint)
<p class="Paragraph SCXW12872475 BCX0" paraid="609014671" paraeid="{50f73fad-9d5e-4573-89ae-0e37c35b3dcb}{153}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 24px; padding: 0px;">Its relatively limited usage is further evidenced by the total available logs on Russian Market, which total over 19,000 infections in 2025 as of late July, compared to over 175,000 infections for LummaC2, according to Flashpoint analysis.&nbsp;
<p class="Paragraph SCXW12872475 BCX0" paraid="844947943" paraeid="{50f73fad-9d5e-4573-89ae-0e37c35b3dcb}{165}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 24px; padding: 0px;">While samples are not available to analyze, Flashpoint was able to develop a YARA rule that could help detect if the malware is compiling logs on victim systems based on the available data. LastPass will continue to monitor activity associated with both Acreed and LummaC2 and post updates as new information becomes available and take all practicable actions to help protect our customers and disrupt these infostealer operations.&nbsp;
&nbsp;

Lumma persists and Acreed Rises

While the rumors of LummaC2’s demise turned out to be a bit exaggerated, Acreed has maintained a foothold within the infostealer market while remaining relatively elusive for defenders. Let's learn more about Acreed malware.

Lumma Persists and Acreed Rises Following Law Enforcement Actions

How to reset your iCloud password if you forgot it

We provide quick answers on how to reset your iCloud password, even if you don’t have access to an email, phone number, or trusted device.  

Forgot Your iCloud Password? Here’s How to Reset It 

The LastPass TIME Team is thrilled to announce the launch of our new podcast The Phish Bowl! Join us every month as my longtime colleague and co-host Mike Kosak and I (Stephanie Schneider) dive into the global cyber threat landscape. Every episode, we&rsquo;ll unpack what&rsquo;s really going on beneath the surface, exploring the globe region by region. We&rsquo;re also publishing a <a href="https://info.lastpass.com/threat-reports">new report</a> for each region on a quarterly basis that will serve as the foundation for the podcast.&nbsp;&nbsp;
When we&rsquo;re looking at what&rsquo;s shaping regional cyber activity, it&rsquo;s helpful to understand the geopolitical environment and factors influencing various actors&rsquo; motivations.&nbsp; Integrating these geopolitical insights with a strategic high-level view of potential threats informs organizations&rsquo; proactive cybersecurity decision-making. It helps security teams better anticipate, identify and respond to threats, and it helps businesses proactively address potential outcomes and contextualize threats specific to their industry, region, or business operations.&nbsp;&nbsp;
For our first episode, we kicked things off with a deep dive into the Asia-Pacific (APAC) region. APAC is one of the most active, complex cyber environments given its dynamic geopolitical environment, economic factors, and flourishing cybercrime scene. We were lucky to be joined by Nate Blumenthal, former senior intelligence advisor to CISA, as our inaugural episode&rsquo;s special guest. Nate shared sharp insights on Iran&rsquo;s cyber posture and its shift towards hybrid warfare in the context of the ongoing conflict in the Middle East. Nate also offered some practical suggestions to improve your own cybersecurity that everyone can implement right now.&nbsp;&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Why APAC matters right now&nbsp;</h2>
APAC cyberattacks trended high last year due to a high number of financially motivated cybercrime and state-backed attacks. This trend has continued this year. APAC experienced the largest share of incidents globally (34%) in 2024, which marks a 13% increase, <a href="https://www.ibm.com/thought-leadership/institute-business-value/report/2025-threat-intelligence-index">according to IBM</a>. From ransomware to credential theft, the region is experiencing a broad range of threats. Industries like manufacturing, finance, and transportation are especially targeted.&nbsp;&nbsp;
Ransomware remains one of the most pervasive threats to the region. Last year, Asia accounted for approximately 11% of global ransomware activity mainly targeting manufacturing and engineering, with India and Japan seeing significant activity. Australia emerged as a top regional ransomware target, and it is among the top 10 of countries impacted based on ransomware gang reporting of alleged victims. There were several victims in Taiwan, Singapore, and Japan. Thailand also saw an unusual increase in victims.&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Nation-state threats: China, North Korea, and Iran&nbsp;</h2>
Beijing-backed hackers have been particularly aggressive and appear to have targeted intellectual property theft, telecom intrusions, and semiconductors. What&rsquo;s interesting is how closely their cyber activity aligns with Beijing&rsquo;s strategic Five-Year Plans that outline goals, objectives, and policy directions. It&rsquo;s like they're handing us a roadmap that aligns with their long-term ambitions.&nbsp;
Then there&rsquo;s North Korea. They&rsquo;ve continued to go after crypto and are infiltrating the workforce in the US and, more recently, expanded to targeting European private entities for malicious purposes, including data exfiltration and extortion and the enablement of cryptocurrency thefts. The scheme involves thousands of DPRK IT workers who use false or stolen identities from people in the US and other countries to obscure their true nationality and get hired at private companies across almost every sector. These North Korean IT workers may seek direct employment with targeted companies or attempt to gain access via third-party vendors and/or contractors. This is all part of an effort to bypass sanctions to raise funds for Pyongyang&rsquo;s regime and weapons programs. The US Department of Justice recently <a href="https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote">announced several actions</a> to combat this scheme.&nbsp;
Nate brought some fantastic perspective on Iran, especially in the context of the recent Israel-Iran conflict. A big takeaway from our conversation is that cyber operations are no longer just a side tactic&mdash;they&rsquo;re central to modern conflict. And the private sector is squarely caught in the crosshairs.&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Cybercrime in Australia&nbsp;</h2>
The rise of cybercrime in APAC has been particularly pervasive in Australia, which has recently emerged as a popular target, especially when it comes to ransomware. For example, Australian airline Qantas was recently breached by Scattered Spider using social engineering tactics in early July 2025, exposing customer data belonging to up to 6 million customers. &nbsp;
The latest in a string of significant attacks targeting Australia-based entities, we explore a recent attack targeting a campaign targeting the country&rsquo;s Association of Superannuation Funds in depth. In March, a credential stuffing campaign targeted multiple large Australian superannuation funds, compromising over 20,000 member accounts. This type of attack takes advantage of individuals who reuse the same password across accounts. Additionally, the attack highlighted a vulnerability within some superannuation funds where MFA was either not offered or not automatically enabled on some accounts. The attackers aimed to commit fraud, attempting fund transfers, with mixed results. &nbsp;
For more on cyber threat environment facing the public and private sectors in Australia, we highly recommend reading the Australian Signals Directorate&rsquo;s Australian Cyber Security Center&rsquo;s (ACSC) latest <a href="https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2023-2024">Annual Cyber Threat Report</a>.&nbsp;The data includes trends and information on threat actor tactics and techniques as well as recommended actionable steps organizations and individuals can take to help mitigate these threats. Our LastPass Labs blog article summarizes the <a href="https://blog.lastpass.com/posts/acsc-2024-report-implications">key takeaways</a>.&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Critical basics to get correct&nbsp;</h2>
Nate also shared four things every organization should be doing right now:&nbsp;
<ol>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Patch and update systems immediately.&nbsp;&nbsp;</li>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Use strong, unique passwords.&nbsp;&nbsp;</li>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Implement multi-factor authentication (MFA).&nbsp;&nbsp;</li>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Train employees on AI-driven phishing and social engineering.&nbsp;</li>
</ol>
As Nate said, &ldquo;The threat is only going to increase&mdash;and AI will make it worse. Awareness and training are key.&rdquo; Getting the basics right will lower your risk exposure, putting you and your organization in a better position to focus on the important stuff knowing you&rsquo;re several steps ahead of the bad guys. &nbsp;
Interested in reading more about improving your cybersecurity posture? We recently shared guidance on&nbsp;<a href="https://blog.lastpass.com/posts/elevate-password-hygiene">password hygiene</a> and how to stay compliant with <a href="https://blog.lastpass.com/posts/stay-compliant-with-new-password-regulations">password regulations</a>. As the recent Entra account takeover campaign demonstrated, <a href="https://blog.lastpass.com/posts/entra-account-takeover-campaign">password hygiene is still the first step</a> to keep your accounts secure. We also explore various <a href="https://blog.lastpass.com/posts/sms-is-insecure">2-factor authentication (2FA) methods</a> and weigh the pros and cons of each.&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Listen to the full episode&nbsp;&nbsp;</h2>
If you&rsquo;ve made it this far, by now you&rsquo;ll have realized that no, we&rsquo;re not a podcast about the 90s jam band Phish&mdash;but we do go deep. If you haven&rsquo;t tuned in yet, we hope you&rsquo;ll give our inaugural episode a listen. We had a blast recording it, and we&rsquo;re just getting started. If you like what you&rsquo;ve heard so far, stay connected with us.&nbsp;&nbsp;
<ul>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Listen to Episode 1 of The Phish Bowl wherever you get your podcasts: &nbsp;<a href="https://www.youtube.com/@LastPass/podcasts"></a></li>
</ul>
<a href="https://www.youtube.com/@LastPass/podcasts">		YouTube</a>
<a href="https://open.spotify.com/show/1TQiFDk9acmkfp1sTFN1yX">		Spotify</a>
<a href="https://podcasts.apple.com/podcast/id1828511920">		Apple</a>
<ul>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Subscribe for monthly threat intel deep dives.&nbsp;</li>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Access LastPass' <a href="https://info.lastpass.com/threat-reports">Regional Report</a> for detailed analysis of recent APAC trends and activity.&nbsp;</li>
 <li class="li6" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Check out the <a href="https://blog.lastpass.com/categories/lastpass-labs">LastPass Labs blog</a> for more insights.&nbsp;</li>
</ul>
Thanks to all our inaugural listeners for taking the plunge with us on the first episode of The Phish Bowl. We'll be back with more threat environment updates in next month&rsquo;s episode talking about North America, along with a corresponding regional report!

Cyber Threats in APAC

What We Covered in the First Episode of The Phish Bowl

Cyber Threats in APAC: What We Covered in the First Episode of The Phish Bowl

The convergence of increasing threat complexity, desktop and mobile diversification, a decentralized workforce, and exponential SaaS expansion has created a critical inflection point for organizations: traditional access management tools are falling short.&nbsp;
They need a robust, scalable solution to secure digital identities, streamline authentication, and maintain viability across an ever-expanding attack surface, all without compromising the user experience.&nbsp;
Enter LastPass Business Max.&nbsp;
LastPass Business Max helps organizations reimagine how they secure access, manage credentials, and gain critical insights into application usage &ndash; without extra agents or user disruption.
And now LastPass Business Max is available on Amazon Web Services (AWS) Marketplace, delivering powerful credential and access management and SaaS monitoring to your AWS-native workflows with just a few clicks.&nbsp;
<h2 class="paragraph" style="color: #000000; margin: 0in;">What Is LastPass Business Max?</h2>

<a rel="noopener noreferrer" href="https://aws.amazon.com/marketplace/pp/prodview-kb2pfb4g3m6pc" target="_blank">LastPass Business Max</a>&nbsp;doesn&rsquo;t just provide best-in-class <a rel="noopener noreferrer" href="https://www.lastpass.com/password-manager" target="_blank" style="color: inherit;">password and access management.</a> It unlocks instant visibility into your entire SaaS footprint &ndash; all through the LastPass Browser extension
&nbsp;
And when over half of technology spend happens outside of IT&rsquo;s control, visibility into your SaaS footprint is no longer optional. It&rsquo;s essential.
&nbsp;
SaaS Monitoring empowers your organization to:
<ul>
 <li class="paragraph" paraid="105884194" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{60}" style="color: #000000; margin: 0in;">Discover Shadow IT and rogue AI tools: Identify every SaaS app in your business environment, whether approved or not.</li>
 <li class="paragraph" paraid="105884194" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{60}" style="color: #000000; margin: 0in;">Monitor app usage and user activity: Detect risky behaviors and enforce policies.</li>
 <li class="paragraph" paraid="105884194" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{60}" style="color: #000000; margin: 0in;">Cut costs and optimize app value: Spot duplicate, unused, or over-provisioned apps to reduce waste.</li>
 <li class="paragraph" paraid="105884194" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{60}" style="color: #000000; margin: 0in;">Stay compliant and secure: Meet regulatory requirements and protect sensitive data with unified visibility.</li>
 <li class="paragraph" paraid="105884194" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{60}" style="color: #000000; margin: 0in;">Prepare for disruptions: Inventory your SaaS apps for continuity planning and to prevent data loss.</li>
</ul>
A browser-based approach means that deployment is frictionless. Users simply carry on with their workflows, while your organization gets a clear lens into what tools are being used and how.
<h2 class="paragraph" paraid="2132862629" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{161}" style="color: #000000; margin: 0in;">Why LastPass Business Max on AWS Marketplace?</h2>

As organizations increasingly adopt hybrid work models and cloud-native tools, procurement needs to be just as agile as the technology it supports.&nbsp;
&nbsp;
By offering LastPass Business Max as part of the <a rel="noopener noreferrer" href="https://aws.amazon.com/partners/" target="_blank" style="color: inherit;">AWS Partner Network</a> (in addition to LastPass Business, which <a rel="noopener noreferrer" href="https://www.lastpass.com/company/newsroom/0d029e50-10e1-4ef3-a668-12a9bb4d70a8" target="_blank" style="color: inherit;">debuted last summer</a> on AWS Marketplace), we&rsquo;re meeting you where you work, empowering seamless procurement and faster time-to-value.&nbsp;
Benefits include:
<ul>
 <li class="paragraph" paraid="1346990980" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{227}" style="color: #000000; margin: 0in;">Simplified purchasing workflows using your existing AWS account</li>
 <li class="paragraph" paraid="1346990980" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{227}" style="color: #000000; margin: 0in;">Flexible billing structures and contract management within AWS</li>
 <li class="paragraph" paraid="1346990980" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{227}" style="color: #000000; margin: 0in;">Rapid deployment with zero additional software or complex installations</li>
 <li class="paragraph" paraid="1346990980" paraeid="{423b3212-87ac-4819-9a7f-c287ff888f7a}{227}" style="color: #000000; margin: 0in;">Transaction convenience with Public Offer, Private Offer, and Channel Partner Private Offer purchasing paths (and free trials!)</li>
</ul>
As an <a rel="noopener noreferrer" href="https://aws.amazon.com/partners/programs/isv-accelerate/" target="_blank" style="color: inherit;">AWS ISV Accelerate Partner</a>, LastPass is increasingly co-sold alongside other leading solutions in the AWS ecosphere. And since LastPass is also deployed on AWS, it unlocks tremendous benefits and rewards for AWS buyers. LastPass is also featured in AWS internal tools and CRM integrations, increasing visibility and Marketplace traction.&nbsp;
<h3 class="paragraph" style="color: #000000; margin: 0in;">Ready to Learn More?</h3>

Securing your business and stopping SaaS sprawl has never been easier. Compare features, read G2 reviews, and try LastPass Business Max free for 14 days on <a rel="noopener noreferrer" href="https://aws.amazon.com/marketplace/pp/prodview-kb2pfb4g3m6pc" target="_blank">AWS Marketplace today</a>.

LastPass Business Max Now Available on AWS Marketplace 

LastPass Business Max is available on Amazon Web Services (AWS) Marketplace, delivering powerful credential and access management and SaaS monitoring. 

Lost your Snapchat My Eyes-Only passcode? How to fix it fast

Learn how you can reset your My Eyes Only passcode.

Lost Your Snapchat My Eyes-Only Passcode? How to Fix It Fast 

Summer is here and that can only mean one thing in the cybersecurity world &ndash; <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/" target="_blank" style="color: inherit;">Black Hat 2025</a>!
&nbsp;
For six days at the <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/travel.html" target="_blank" style="color: inherit;">Mandalay Bay Convention Center</a> in Las Vegas (August 2-7), the cyber world will come together for events, trainings, briefings, and networking &ndash; affectionately referred to as &ldquo;hacker summer camp.&rdquo;&nbsp;
&nbsp;
Best of all, LastPass will be there &ndash; <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/registration.html" target="_blank" style="color: inherit;">will you</a>?&nbsp;Read on for your LastPass itinerary at Black Hat 2025.&nbsp;
<h2 class="paragraph" paraid="1521409206" paraeid="{8cfdb4d7-d017-452d-add9-b8313e3325fc}{115}" style="color: #000000; margin: 0in;">LastPass at Black Hat 2025: Booth 5311</h2>

Stop by booth 5311 for demos, games, and (of course) swag!
&nbsp;
Demo LastPass and our new <a rel="noopener noreferrer" href="https://www.lastpass.com/features/saas-monitoring" target="_blank" style="color: inherit;"></a><a href="https://www.lastpass.com/features/saas-monitoring" target="_blank" style="color: inherit;">SaaS Monitoring</a> feature, which gives you high-level app visibility with ground-level controls. Learn how you can eliminate app blind spots in your organization and unlock the cheat code to Shadow IT.
&nbsp;
See how LastPass can help protect your business from threats &ndash; both known and unknown. Stop by for a demo and walk away with your own LED 8-bit sword.
&nbsp;
Need a break from the action? Take on a co-worker or a new conference buddy with some old school video games at our booth (calling all Street Fighter and Donkey Kong fans!).
&nbsp;
And no conference is complete without a party. Bring your short game to the GuidePoint Security Black Hat Party at Swingers &ndash; The Crazy Golf Club (at Mandalay Bay) on August 5 at 6:30pm (<a rel="noopener noreferrer" href="https://www.guidepointsecurity.com/black-hat/?utm_source=vendor&amp;utm_medium=email&amp;utm_campaign=2025_08_05_corp_mq_blackhat_party_swingers_vegas&amp;utm_vendor=last_pass" target="_blank" style="color: inherit;">register here</a>).
<h2 class="paragraph" paraid="966987688" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{14}" style="color: #000000; margin: 0in;">Black Hat 2025 Trainings</h2>

Black Hat 2025 kicks off with four days of specialized <a rel="noopener noreferrer" href="https://blackhat.com/us-25/training/schedule/index.html" target="_blank" style="color: inherit;">cybersecurity Trainings</a> (August 2-5) with courses for all skill levels. Trainings are both in-person and online (via Zoom), covering everything from pen testing, cloud security, AI and machine learning safety, incident response, malware analysis, and much, much more.
<h3 class="paragraph" paraid="1114778732" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{59}" style="color: #000000; margin: 0in;">What can you expect at Black Hat Trainings?</h3>
<ul>
 <li class="paragraph" paraid="1114778732" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{59}" style="color: #000000; margin: 0in;">Hands-on experience through immersive labs, live demos, and practical exercises for either two or four-day sessions.&nbsp;</li>
 <li class="paragraph" paraid="1114778732" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{59}" style="color: #000000; margin: 0in;">A digital <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/certifications.html" target="_blank" style="color: inherit;">Black Hat Training Certification</a> after completion.</li>
 <li class="paragraph" paraid="1114778732" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{59}" style="color: #000000; margin: 0in;">Continuing Professional Education (CPE) credits for those who are certified through ISC2 (16 credits for 2-day sessions; 32 for 4-day sessions). </li>
 <li class="paragraph" paraid="1114778732" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{59}" style="color: #000000; margin: 0in;">An extra two hours of interactive Q&amp;A with your course instructors (&ldquo;Office Hours&rdquo;), held virtually via Zoom around one month after the event.</li>
</ul>
For easier scheduling and venue navigation, be sure to download the <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/app.html" target="_blank" style="color: inherit;">Black Hat app</a>.&nbsp;
<h2 class="paragraph" paraid="374395610" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{147}" style="color: #000000; margin: 0in;">Black Hat 2025 Summit Day &amp; Briefings</h2>

<a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summits.html" target="_blank" style="color: inherit;">Summit Day</a> is Tuesday, August 5. Black Hat Summits bring together industry experts who are keen to share actionable insights on emerging technologies and topical challenges. This year&rsquo;s Summits include:&nbsp;
<ul>
 <li class="paragraph" paraid="1227558515" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{157}" style="color: #000000; margin: 0in;"><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/index.html#track/ciso-summit" target="_blank" style="color: inherit;">CISO Summit</a></li>
 <li class="paragraph" paraid="1227558515" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{157}" style="color: #000000; margin: 0in;"><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/index.html#track/ciso-summit" target="_blank" style="color: inherit;"></a><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/index.html#track/the-ai-summit" target="_blank" style="color: inherit;">AI Summit</a></li>
 <li class="paragraph" paraid="1227558515" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{157}" style="color: #000000; margin: 0in;"><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/index.html#track/the-ai-summit" target="_blank" style="color: inherit;"></a><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/index.html#track/financial-services-summit" target="_blank" style="color: inherit;">Financial Services Summit</a></li>
 <li class="paragraph" paraid="1227558515" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{157}" style="color: #000000; margin: 0in;"><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/index.html#track/financial-services-summit" target="_blank" style="color: inherit;"></a><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/#track/innovators--investors-summit" target="_blank" style="color: inherit;">Innovators &amp; Investors Summit</a></li>
 <li class="paragraph" paraid="1227558515" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{157}" style="color: #000000; margin: 0in;"><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/summit-sessions/schedule/#track/innovators--investors-summit" target="_blank" style="color: inherit;"></a><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/omdia-analyst-summit.html" target="_blank" style="color: inherit;">Omdia Analyst Summit</a></li>
 <li class="paragraph" paraid="1227558515" paraeid="{a5e179d1-7d08-4f90-a7b4-552d93b88983}{157}" style="color: #000000; margin: 0in;"><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/omdia-analyst-summit.html" target="_blank" style="color: inherit;"></a><a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/micro-summits.html" target="_blank" style="color: inherit;">Micro Summits</a> (cyber insurance, Industrial Control Systems, and supply chain)</li>
</ul>
And learn about the latest cybersecurity risks and trends at more than 100 <a rel="noopener noreferrer" href="https://blackhat.com/us-25/briefings/schedule/index.html" target="_blank" style="color: inherit;">Black Hat Briefings</a> (August 6-7), where global security pros take you through cutting-edge research. Miss a Briefing? On-demand access to all recorded Briefings will be available after the conference. (You can get 25% off Briefing tickets <a rel="noopener noreferrer" href="https://blackhat.informafestivals.com/usa/2025/registrations/SPBHP25?_pc=25-ZZYP34" target="_blank" style="color: inherit;">here</a>.)
&nbsp;
August 6-7 you can also attend <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/business-hall.html" target="_blank" style="color: inherit;">The Business Hall</a> to network with thousands of cybersecurity professionals and demo security products and solutions. It&rsquo;s the perfect place to engage and evaluate with your peers.&nbsp;
&nbsp;
Hacker summer camp is fast approaching. Get excited and <a rel="noopener noreferrer" href="https://www.blackhat.com/us-25/registration.html" target="_blank" style="color: inherit;">get registered</a> &ndash; we'll see you in Las Vegas soon!

Join LastPass at Black Hat 2025 

Join LastPass at Black Hat 2025 in Las Vegas, Nevada. 

Viva Las Vegas! Join LastPass at Black Hat 2025

Forgot your iPhone screen time password? Here’s how to reset it fast

We answer your most frustrating screen time passcode questions and reveal the easiest way to avoid forgotten passcodes and endless lockouts.

Forgot Your iPhone Screen Time Password? Here’s How to Reset It Fast

How to Reset Your Hotmail Password Quickly and Safely

Learn how to reset your Hotmail password in minutes. 

Attackers are using the TeamFiltration pentesting framework to conduct brute-force attacks against Microsoft Entra ID accounts in an ongoing campaign, according to Proofpoint. TeamFiltration is designed to simulate account takeover (ATO) attacks in Microsoft cloud environments, specifically targeting Entra ID (formerly Azure Active Directory). Entra ID is a core component of Microsoft&rsquo;s cloud identity and access management services and is widely used, especially among small and medium sized businesses. This campaign strategy combines trusted platforms, global infrastructure, and evasive techniques to maximize impact while minimizing detection. This campaign is an efficient way to breach cloud environments by essentially taking advantage of weak passwords. Passwords were the primary target and attack vector in this campaign which demonstrates that even in a cloud-first world, password hygiene is still a frontline defense.
Campaign details
TeamFiltration has historically been a popularly exploited legitimate tool since it was released in 2021 because the tool provides both white and black hat hackers with a solid framework to take over Office 365 Entra ID accounts, data exfiltration, and persistent access. Proofpoint attributed the recent surge in login attempts to UNK_SneakyStrike. Starting in December 2024 and peaking in January 2025, this <a href="https://www.proofpoint.com/us/blog/threat-insight/attackers-unleash-teamfiltration-account-takeover-campaign">campaign</a> has targeted over 80,000 user accounts across approximately 100 cloud tenants or organizations and have resulted in multiple successful account takeovers. How passwords factored into the attack: 
<ol>
 <li>Enumeration first: The attackers used the Microsoft Teams API to identify valid usernames within organizations and ensure they weren&rsquo;t wasting time on nonexistent accounts. </li>
 <li>Password spraying: Once UNK_SneakyStrike had a list of valid usernames, they launched waves of login attempts using common passwords like &ldquo;Password123.&rdquo; These attempts were spread across Amazon Web Services (AWS) servers in different regions to avoid detection. </li>
 <li>Account takeover: If a password matched, the attacker gained access to the account. From there, they could exfiltrate data, move laterally, or maintain persistence using tools like OneDrive backdoors. </li>
</ol>

&nbsp;<img src="https://www.lastpass.com/-/media/7cdd7236d94142ca9e3f1e8877726332.png" >
UNK_SneakyStrike velocity by volume of unauthorized access attempts using TeamFiltration over time (July 2024 &ndash; March 2025). (Source: Proofpoint)
&nbsp;
Notable campaign takeaways: 
<ol>
 <li>The attackers used a low sophistication technique called password spraying, which relies on trying to find common or previously breached passwords across many users accounts rather than brute-forcing a single account to gain initial access. The success of this attack hinged on users reusing weak passwords and organizations not enforcing strong authentication policies. </li>
 <li>The campaign follows a trend where threat actors weaponize legitimate tools and platforms like TeamFiltration and Microsoft Teams API instead of using less effective, traditional intrusion methods. This makes detecting malicious vs. legitimate traffic much more difficult. In this campaign, researchers were able to weed out real-world malicious activity from legitimate penetration tests. They determined UNK_SneakyStrike demonstrated broader, indiscriminate targeting patterns, whereas legitimate red team penetration testing occurred over a smaller window. And since Microsoft Teams is a widely used collaboration tool, its API is often trusted and is less likely to trigger security alerts. This makes Teams an attractive tool for threat actors trying to blend in with legitimate traffic. </li>
 <li>Attackers also relied on AWS infrastructure, which is required by the TeamFiltration tool for intrusion simulations because its password spraying function supports rotation across different AWS regions. Using AWS servers in multiple regions helps attackers bypass geo-based security controls and distribute attacks to avoid detection. As entities have migrated to the cloud, threat actors have followed suit. </li>
</ol>
Defensive recommendations 
Defending against attacks that exploit the Microsoft Teams API and AWS infrastructure for user enumeration and password spraying requires a layered, cloud-aware security strategy. Some key defenses include: 
<ol>
 <li>Conditional access policies: Implement conditional access controls in Microsoft Entra ID. For example, block or challenge logins from unfamiliar geographic locations and require MFA for suspicious sign-ins or new devices.</li>
 <li>Rate limiting and geo-fencing: Apply rate limits to authentication attempts via APIs, restrict access to Teams APIs from known or expected IP ranges, and use geo-fencing to block or alert on traffic from regions where your users don&rsquo;t operate. </li>
 <li>Monitoring and detection: Enable audit logging and monitor for unusual patterns like repeated failed logins from multiple IDs, or high-volume API calls from cloud providers like AWS. Use SIEM tools to correlate events across services and detect distributed attacks. </li>
 <li>Hardened authentication: Enforce MFA for all users and especially administrators. This adds an extra layer of defense. Even if an attacker got access to a password, MFA is an added blockade to stop them from simply logging in and gaining account access. When you can, use passwordless authentication methods like FIDO2 keys or authenticator apps. </li>
 <li>Use a password manager. A password manager can&rsquo;t stop attackers from launching password spraying campaigns, but it can help make you a terrible target. The bad guys are going to do what they&rsquo;re going to do, or at least try, and they&rsquo;re more likely to go after low-hanging fruit. Password managers like LastPass can help protect against password spraying by promoting strong, unique passwords and generating passwords to avoid weak or recycled passwords, which attackers exploit in spraying. They can also integrate with MFA, adding an extra layer of protection. Additionally, LastPass&rsquo; dark web monitoring proactively checks customers' email addresses for breached credentials, so folks could be alerted before malicious activity is attempted.</li>
 <li>User awareness and hygiene: People are the double-edged sword in cybersecurity &ndash; they&rsquo;re often the weakest link but also the first line of defense. Educate users about phishing and credential stuffing so they can be on the lookout for suspicious activity and be informed about why good cyber hygiene, like using unique passwords, matters. </li>
</ol>

Entra account takeover campaign shows why password hygiene is still king

Attackers are using the TeamFiltration pentesting framework to conduct brute-force attacks against Microsoft Entra ID accounts in an ongoing campaign. Passwords were the primary target and attack vector in this campaign which demonstrates that even in a cloud-first world, password hygiene is still a frontline defense.

Entra Account Takeover Campaign Shows Why Password Hygiene is Still King

The secret world of pretexting: An insider’s look into the art of deception

We explore pretexting, the art of building trust with a well-crafted lie.

The Secret World of Pretexting: An Insider Look into the Art of Deception  

Artificial Intelligence (AI) presents a massive opportunity for companies to increase velocity, productivity, efficiency, and innovation. However, given its fast-changing nature and employee demand, risks arise when business and customers outpace the ability to ensure scalable, secure, and private AI services&nbsp;
&nbsp;
These risks can include:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Data leakage&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Ungoverned use&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Regulatory non-compliance&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Unexpected costs&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">AI ecosystem changes&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Complexity and instability&nbsp;</li>
</ul>
To navigate this complex terrain, LastPass partnered with <a href="https://stackaware.com/">StackAware</a>, a firm specializing in AI risk management and governance.&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 8px;">Challenge&nbsp;</h2>
As LastPass carefully integrates AI across its products and operations, our focus is to ensure responsible, ethical, safe and secure use while maintaining a stringent emphasis on security and privacy. This requires addressing several key challenges:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">The need to streamline security and privacy processes, guardrails and controls for existing and new AI implementations. &nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Ensuring compliance with emerging AI laws, regulatory guidance, and industry frameworks.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Reviewing and addressing data handling practices of third-party AI tools.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Ensuring employee AI use aligns to the company&rsquo;s acceptable use policies, avoiding the risk of Shadow AI.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Oversight by the Executive team and Board of Directors as part of the company&rsquo;s risk management framework.&nbsp;</li>
</ul>
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 8px;">Solution&nbsp;</h2>
LastPass engaged StackAware to develop a comprehensive AI governance program.&nbsp;&nbsp;Together we leveraged:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">National Institute of Standards and Technology (NIST) AI Risk Management Framework (<a href="https://www.nist.gov/itl/ai-risk-management-framework">RMF</a>)&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Open Web Application Security Project (<a href="https://owasp.org/www-project-top-10-for-large-language-model-applications/">OWASP</a>) Top 10 risks for Large Language Models (LLM)&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">System and Organization Controls&nbsp;(<a href="https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2">SOC</a>) 2&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li4" style="color: #181818; margin: 0px;">ISO <a href="https://www.iso.org/standard/27001">27001</a></li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li4" style="color: #181818; margin: 0px;">ISO <a href="https://www.iso.org/standard/71670.html">27701</a></li>
</ul>
This collaboration focused on several key areas:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">AI risk assessment. StackAware assessed LastPass&rsquo; systems which make use of AI, identifying potential areas for improvement and providing actionable recommendations aligned with best practices and the frameworks described above.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Vendor review. We jointly completed a thorough review of the vendors used by LastPass - including the underlying AI systems and models - to understand whether and how they would process LastPass&rsquo; or its customers&rsquo; data with AI.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Streamlining security and privacy reviews. In addition to due diligence on existing vendors, StackAware improved the security and privacy review process for both commercial and open-source AI systems and models. This reduced friction and accelerated timely deployment while maintaining security.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Governance development. With StackAware&rsquo;s help, LastPass built robust AI governance policies and processes, addressing data handling, secure development and ethical AI use.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Employee training. After the governance framework was in place, LastPass leveraged StackAware to develop training around common risks associated with AI use and how to mitigate them using LastPass processes and procedures.&nbsp;</li>
</ul>
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 8px;">Results&nbsp;</h2>
At the end of the engagement with StackAware, LastPass had:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">A structured approach to identify, assess, and mitigate AI-related risks.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">Compliance framework considerations integrated into the company&rsquo;s governance program.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li2" style="color: #181818; margin: 0px;">The ability to balance innovation with security, allowing LastPass to move forward with AI initiatives confidently.&nbsp;</li>
</ul>
&ldquo;As we embrace AI, ensuring its secure and responsible use is paramount,&rdquo; said Mario Platt, Chief Information Security Officer at LastPass. &ldquo;StackAware has brought deep expertise in AI governance and risk management, helping us implement a structured, standards-aligned approach to identifying and mitigating AI-related risks. Their guidance empowered us to innovate with confidence, while upholding the trust our customers expect.&rdquo;&nbsp;
&nbsp;
Christofer Hoff, Chief Secure Technology Officer, added that &ldquo;AI isn&rsquo;t just another technology shift&mdash;it&rsquo;s a trust shift. StackAware helped us translate complex compliance frameworks into practical, actionable steps. Their work enabled us to move fast without breaking trust&mdash;balancing innovation with the security and privacy our users expect.&rdquo;&nbsp;
&nbsp;
With the StackAware engagement complete, LastPass is well prepared to navigate the complex artificial intelligence landscape while upholding its commitments to its customers and ensure the responsible, ethical, safe and secure use of AI while maintaining a stringent focus on security and privacy.&nbsp;

How LastPass Fortified AI Governance and Security with StackAware

LastPass partnered with StackAware, a firm specializing in AI risk management and governance. 

How LastPass Fortified AI Governance and Security with StackAware 

The hidden dangers lurking in your logins – and the fast, easy fixes you aren’t (yet) using 

We pull back the curtain on how passwords are getting cracked in 2025 and how LastPass can be your first line of defense.

The Hidden Dangers Lurking in Your Logins – and the Fast, Easy Fixes You Aren’t (Yet) Using

What is a Trojan Virus?

Understand the risks of trojan viruses and discover how LastPass's robust security measures safeguard your information. 

Understanding Trojan Viruses and How to Protect Your Devices

<h2>Tips to Check If a Link Is Safe </h2>
Checking to see if a link is secure might feel like an extra step or a hassle in an already busy day, but it&rsquo;s easy to make a few steps a quick habit that can prevent a future headache.&nbsp;
<h3>Verify the source of the link </h3>
Before clicking on a link, take a moment to verify its source. Ask yourself:&nbsp;
<ul>
 <li>Who sent the link? Is it from someone you know and trust?&nbsp;</li>
 <li>Is the sender's email address or social media profile legitimate? Look for subtle discrepancies, like slight misspellings in the domain name.&nbsp;</li>
 <li>Does the message context make sense? If you receive an unexpected link, especially one urging immediate action, be wary. </li>
</ul>
<h3>Check for HTTPS and secure connections </h3>
A secure website will use HTTPS (HyperText Transfer Protocol Secure) rather than HTTP. HTTPS encrypts the data exchanged between your browser and the website, making it significantly harder for cybercriminals to intercept and manipulate the information. Always look for a padlock icon in the address bar and ensure the URL begins with "https://" before entering any personal information.&nbsp;
<h3>Use URL scanning tools </h3>
Several online tools are available to help you check the safety of a link before you click on it. These tools can analyze a URL and provide a report on its safety. Some popular options include:&nbsp;
<ul>
 <li>Google Safe Browsing: Integrated into browsers like Chrome, this tool warns you about potentially dangerous sites.&nbsp;</li>
 <li><a href="https://safeweb.norton.com/" target="_blank" rel="noopener noreferrer">Norton Safe Web</a>: This tool provides safety ratings for websites based on user feedback and threat analysis.&nbsp;</li>
</ul>
Using these tools can reduce the risk of online threats and help protect users online.&nbsp;
To summarize, here&rsquo;s &ldquo;how to check if a link is safe&rdquo;:
First, you&rsquo;ll want to verify the source of the link, credibility of the sender, and rationale behind the email. If there aren&rsquo;t satisfactory answers to the three questions above, it&rsquo;s best to refrain from clicking on the link.
Second, make sure the URL begins with HTTPS, rather than the less secure HTTP.
Third, use link scanning tools like Google Safe Browsing and Norton Safe Web before clicking on links in unsolicited emails.
<h2>How to Check if a Link Is Safe on an iPhone </h2>
<h3>Preview link in Safari </h3>
On an iPhone, Safari allows you to preview a link before committing to a click. This feature is handy for checking the destination of a link without opening it. To use this feature, press and hold the link until a preview window appears. This preview can help you verify the URL and assess whether it looks legitimate.&nbsp;
<h3>Scan website tool in Safari </h3>
Safari also includes a built-in tool that checks the safety of websites you visit. This tool uses a database of known malicious websites to provide warnings when you attempt to visit a potentially dangerous site. To ensure this feature is enabled, go to Settings &gt; Safari &gt; Fraudulent Website Warning and make sure the toggle is turned on. This tool adds an extra layer of protection, alerting you to threats before they can cause harm.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/create-account.php?premium=1" target="_blank"><button class="lp-button lp-button--primary">Try Premium</button></a></div>
<h2>How to Check if a Link Is Safe on an Android </h2>
<h3>Update security settings </h3>
Keeping your Android device&rsquo;s security settings up to date is crucial for protecting against malicious links. Navigate to Settings &gt; Security and ensure that features like "Google Play Protect" and "Safe Browsing" are enabled. These settings help detect and prevent threats from affecting your device.&nbsp;
<h3>Enable Play Protect </h3>
Google Play Protect is a built-in security service that scans apps and links for potential threats. To enable it, open the Google Play Store, tap the menu icon, and select "Play Protect." Ensure it is turned on to benefit from real-time protection. Play Protect continuously scans your device for harmful behavior, helping to keep your data safe.&nbsp;&nbsp;
<h2>What to Do If You Click on a Malicious Link </h2>
<h3>Recognizing signs of a malicious link </h3>
After clicking a link, you might notice several red flags indicating that the link was malicious:&nbsp;
<ul>
 <li>Unexpected pop-ups: A sudden influx of pop-up ads or messages can signify malware infection.&nbsp;</li>
 <li>Slow device performance: Malware can run in the background, consuming resources and slowing down your device.&nbsp;</li>
 <li>Unauthorized changes: Be alert for changes to your device&rsquo;s settings or the appearance of unfamiliar apps, which could indicate malware activity. </li>
</ul>
<h3>Steps to take after clicking on a suspicious link </h3>
If you realize you&rsquo;ve clicked on a malicious link, take immediate action to mitigate potential damage:&nbsp;
<ul>
 <li>Disconnect from the Internet: This step can prevent malware from communicating with its command center or spreading further.&nbsp;</li>
 <li>Scan your device: Use reputable antivirus or anti-malware software to perform a thorough scan of your device and remove any detected threats.&nbsp;</li>
 <li>Change your passwords: Update passwords for sensitive accounts, prioritizing those linked to financial information or personal data.&nbsp;</li>
 <li>Monitor your accounts: Keep a close watch on your financial and online accounts for any signs of unauthorized activity. Report any suspicious transactions to your bank or service provider immediately. Some security tools like LastPass offer <a href="https://www.lastpass.com/features/dark-web-monitoring" target="_blank" rel="noopener noreferrer">dark web monitoring</a> to help users catch potential data breaches early and monitor any leaks of sensitive information.&nbsp;</li>
</ul>
<h3>Reporting and blocking malicious links </h3>
Reporting malicious links helps protect others from falling victim to similar threats. You can report suspicious links to your email provider or the website hosting the link. Additionally, use your browser's tools to block the site and prevent future access. Many browsers offer built-in features to report phishing sites and malicious content, contributing to a safer online environment for everyone.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/create-account.php?premium=1" target="_blank"><button class="lp-button lp-button--primary">Try Premium</button></a></div>
<h2>Stay Protected From Malicious Links </h2>
<h3>Importance of using a reliable link checker </h3>
Link checkers are tools that can detect and warn users about potential threats, significantly reducing the risk of clicking on dangerous links. By incorporating link checkers into your daily browsing habits, you can enhance your security and protect your personal information.&nbsp;
<h3>Benefits of LastPass in link safety </h3>
LastPass is widely known for its password management capabilities, but it also offers features that enhance link safety. By storing and autofilling passwords securely, LastPass helps you avoid phishing sites that try to steal your login credentials. Additionally, LastPass can generate complex, unique passwords for each of your accounts, further protecting against threats. Integrating LastPass into your online routine adds a layer of security against malicious links and phishing attempts.&nbsp;
<h3>Additional security measures for safe browsing </h3>
In addition to using link checkers and password managers, several other measures can help ensure safe browsing:&nbsp;
<ul>
 <li>Keep software updated: Regularly update your operating system, browsers, and security software to protect against the latest threats. Cybercriminals often exploit vulnerabilities in outdated software, so installing updates and patches is key. &nbsp;</li>
 <li>Use strong, unique passwords: Avoid reusing passwords across multiple accounts. Using a password manager like LastPass <a href="https://www.lastpass.com/features/password-generator" target="_blank" rel="noopener noreferrer">helps users create</a> and store strong, unique passwords for each account, which means that even if one account password is compromised, it can&rsquo;t be used across every account. LastPass not only stores and protects your passwords, but also lets admin users set a minimum requirement for length and complexity. &nbsp;</li>
 <li>Enable <a href="https://www.lastpass.com/features/password-generator" target="_blank" rel="noopener noreferrer">two-factor authentication (2FA)</a>: Add an extra layer of security to your accounts by enabling 2FA, which requires a second form of verification (such as a code sent to a user's phone) in addition to an account password.&nbsp;</li>
 <li>Prioritize <a href="https://www.lastpass.com/resources/webinars" target="_blank" rel="noopener noreferrer">learning and education</a>: Staying informed about the latest cybersecurity threats and best practices can reduce risk and improve user security. &nbsp;</li>
</ul>
Ensuring link safety is a critical component of maintaining against online-based threats, and adopting these practices will help you navigate the digital world with confidence and peace of mind. <a href="https://lastpass.com/create-account.php?premium" target="_blank" rel="noopener noreferrer">Start your free LastPass trial today</a>. &nbsp;
<h2 class="p1" style="color: #0f374e; margin-right: 0px; margin-bottom: 5.3px; margin-left: 0px;">FAQ</h2>
<h3 class="p3" style="color: #0f374e; margin: 0px 0px 5.3px;">What is the SLAM method?</h3>
The SLAM method is used to determine if a link is safe. The acronym represents a <a href="https://dailysecurityreview.com/blog/what-is-the-slam-method/">four-step framework</a> that involves double-checking the Sender, Link, Attachment, and Message.
<ul>
 <li class="p4" style="color: #000000; margin: 0px 0px 10.7px;">S = Stop before acting (Think before clicking on links or attachments</li>
 <li class="p4" style="color: #000000; margin: 0px 0px 10.7px;">L = Look closely for red flags (Examine the sending address for evidence of spoofing, and hover over links to see whether they direct to legitimate or questionable URLs)</li>
 <li class="p4" style="color: #000000; margin: 0px 0px 10.7px;">A = Ask a trusted source to confirm the authenticity of emails (Work with IT staff to validate emails before clicking on any links or attachments)</li>
 <li class="p4" style="color: #000000; margin: 0px 0px 10.7px;">M = Manage according to best practices (Follow corporate policies on handling phishing emails)</li>
</ul>
<h3 class="p3" style="color: #0f374e; margin: 0px 0px 5.3px;">How to check if a site is legit?</h3>
To <a href="https://www.consumersearch.com/technology/ultimate-guide-verify-website-legitimate">check if a site is legit</a>:
<ul>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Look for a secure connection between your browser and the website server (HTTPS instead of HTTP) by <a href="https://www.makeuseof.com/how-to-check-if-website-is-secure/">checking for a lock icon</a>.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Check to ensure there aren&rsquo;t <a href="https://www.makeuseof.com/how-to-check-if-website-is-secure/">any errors or slight discrepancies in the URL</a> or address.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Look for Trustpilot reviews, which can reveal how consumers view the site.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Check for key site elements, such as contact info, customer reviews, privacy and delivery policies, and certifications from reputable organizations.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Look for quality in site design and ease-of-use in navigation.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">To see whether an organization is well-established, investigate their social media accounts.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Determine if the content is well-written, informative, and error-free.</li>
 <li class="p8" style="color: #386573; margin: 0px 0px 10.7px;">Use online tools like &ldquo;Whois Lookup&rdquo; to get info about domain registration details, including the owner&rsquo;s name, contact information, and registration date.</li>
</ul>
<h3 class="p3" style="color: #0f374e; margin: 0px 0px 5.3px;">Is there a way to check if a link is safe?</h3>
To check if a link is safe:
<ul>
 <li class="p2" style="color: #26262a; margin: 0px;">Use <a href="https://www.marketingscoop.com/tech/11-best-url-scanners-to-check-if-a-link-is-safe/">URL scanning tools</a> like Google Safe Browsing, Norton Safe Web, or VirusTotal.</li>
 <li class="p2" style="color: #26262a; margin: 0px;">For iPhone, enable the link preview and fraudulent website warning tool on Safari.</li>
 <li class="p2" style="color: #26262a; margin: 0px;">For Android, ensure that features like &ldquo;Google Play Protect" and "Safe Browsing" are enabled.</li>
 <li class="p2" style="color: #26262a; margin: 0px;">Check for secure HTTPS connections by looking for a padlock icon next to the address bar.</li>
</ul>

How to Check if a Link is Safe

Learn how to verify the safety of a link before clicking. Follow LastPass’s expert tips to protect yourself from phishing and malicious websites. 

Blog

Blog

Recent

Industry News

LastPass For Admins

LastPass Labs

Product Updates

Tips And Tricks

Introducing Secure Access Experiences: Controlling the Chaos of Modern App Sprawl

Understanding Trojan Viruses and How to Protect Your Devices

How to Check if a Link Is Safe

Lumma Persists and Acreed Rises Following Law Enforcement Actions

Forgot Your iCloud Password? Here’s How to Reset It

Subscribe for the latest from LastPass blog

Cyber Threats in APAC: What We Covered in the First Episode of The Phish Bowl

LastPass Business Max Now Available on AWS Marketplace

Lost Your Snapchat My Eyes-Only Passcode? How to Fix It Fast

Viva Las Vegas! Join LastPass at Black Hat 2025

Forgot Your iPhone Screen Time Password? Here’s How to Reset It Fast

How to Reset Your Hotmail Password Quickly and Safely

Entra Account Takeover Campaign Shows Why Password Hygiene is Still King

The Secret World of Pretexting: An Insider Look into the Art of Deception

How LastPass Fortified AI Governance and Security with StackAware

The Hidden Dangers Lurking in Your Logins – and the Fast, Easy Fixes You Aren’t (Yet) Using