Klue Supply Chain Incident & LastPass Response

LastPass wants to inform our customers of a security incident which recently occurred at one of our third-party suppliers and how that incident impacts LastPass and our customers.

Get LastPass Free

Create and store secure passwords for yourself, your team or business.

Why LastPass?

Remember fewer passwords and log in faster with our browser extension.

How LastPass works

LastPass zero-knowledge security model keeps your data private even from us.

Security Architecture

Compare LastPass competitors, plans, and features in one place

Compare LastPass

Overview

Password management

Save and autofill

Password generator

Password sharing

Passkeys

Dark web monitoring

Security dashboard

Key Features

Free LastPass Premium trial, no credit card required.

Free LastPass Business trial, no credit card required.

Let our experts help you find the right plan and successfully deploy LastPass.

Sync passwords across all devices, monitor password health, data breaches and much more.

Personal

Premium password management for family or group of 6 people.

Families

Personal Plans

Password vault

Save & autofill

Mobile Smart Scanner

Automatic device sync

Emergency access

Personal password sharing

FOR INDIVIDUALS

30-day free LastPass Premium trial, no credit card required.

30-day free LastPass Families trial, no credit card required.

Limited to 1 device type and basic password management features.

Designed for businesses of all sizes, from small startups to enterprises.

Business

Simplify secure access straight from the browser with more admin control.

Business Max

For single teams just getting started with password management.

Teams

Designed to keep your clients' credentials protected and private.

Business Plans

User management

SaaS Monitoring

SaaS Protect

Secure Access Essentials

Business sharing

Multifactor Authentication

Integrations

Single Sign-on

Identity management

For admins

Marketing teams

Legal teams

HR teams

Business leaders

IT admins

Solutions by role

Case studies

Webinars

Product demos

Events

Trust Center

Compliance Center

Security architecture

LastPass University

Resource Center

Pricing

Join the LastPass Partner Program to provide even more value to your customers.

Partner program overview

Managed Service Providers

Resellers

Cloud marketplaces

Technology Alliance Partners

LastPass Partner Program

Grow new revenue streams by meeting customer's security needs.

Looking for help or interested in becoming a LastPass partner? Get in touch with our partner team.

Connect with trusted LastPass Partners to support your security needs.

Partners

Self-service library of resources and guides for all LastPass products.

Support Center

Community forum

System status

Help

Personal support for all LastPass’ subscribed customers.

Support

Get LastPass free

Submit sales inquiry

Chat with sales

Request a demo

Find a partner

Contact sales

Log in

10 controls to validate before you deploy agentic AI

<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="50" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1">"An agent is equivalent to a newly hired employee. It needs a unique identity,&nbsp;least&nbsp;privilege&nbsp;access, and monitoring to watch what it's doing."&nbsp;~&nbsp;Rafay Baloch, CEO, REDSECLABS</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="50" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1">"The attack surface most organizations are unprepared to defend is&nbsp;the&nbsp;one where agents&nbsp;are still&nbsp;making&nbsp;API calls after the developer who built them left the company."&nbsp;~&nbsp;Roey Eliyahu, CEO, Salt Security</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="50" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1">"The higher the business impact and the harder it is to reverse an action, the more human oversight should be required."&nbsp;~&nbsp;Sherif Koussa, CEO, Software Secured</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="50" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="4" data-aria-level="1">"The model is your reasoning layer. The APIs it connects to are your action layer. Most organizations&nbsp;focus&nbsp;on locking down reasoning&nbsp;while leaving&nbsp;the action layer wide open."&nbsp;~&nbsp;Michael Callahan, VP of Cyber Strategy, Salt Security</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="50" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="5" data-aria-level="1">"Before deploying any agent into production, you need a complete trail showing inputs, outputs, decisions, tool usage, and user approvals."&nbsp;~&nbsp;Deepak Shukla, CEO, Pearl Lemon AI</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="50" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="6" data-aria-level="1">Most SMBs discover unauthorized AI tool usage after it has already become a liability. LastPass surfaces&nbsp;every&nbsp;AI tool your team is accessing&nbsp;in the browser,&nbsp;without infrastructure changes or a security team.</li>
</ul>

What security experts and business leaders say about agentic AI risk

FAQs: 2026 Agentic AI security checklist

Attention business owners: Get your 2026 agentic AI security checklist right now 

Your 2026 Agentic AI Security Checklist: 10 Controls to Validate Before You Deploy 

<div id="calloutcontent1">&nbsp;</div>
Secure access starts with a simple truth: You can't protect what you can't access securely.
And for most people, the first step of getting passwords into a secure vault is where momentum breaks down.
Before Zero Trust, autofill, or Dark Web Monitoring can keep you safe, there's one foundational step everything depends on: capturing and securing every login.
Getting this first step right sets the stage for secure access.
That's why <a href="https://blog.lastpass.com/posts/secure-access-essentials">Secure Access Essentials</a> begins with something simple: removing friction from how you enter passwords into your vault.
As a first in the password management space, we're introducing Mobile Smart Scanner to remove that friction.
<h2>The one change that makes every login in your life easier</h2>
In 2026, the work-life boundary has shifted.
Work follows you everywhere.
You're switching between devices and logging into dozens of accounts daily.
At the same time, your passwords are stored in too many places. And you're reusing them across sites because it's easier.
Unfortunately, that also makes account takeovers far more likely.
As the threats rise, secure access is no longer optional &mdash; it's essential. That means simplifying the way your passwords move from paper to secure vault isn't just about convenience.
When you can quickly get your credentials organized, security feels intuitive and less like a chore. This one simple shift keeps you safer.
Innovation in security matters. Instead of asking you to change how you live, we focused on making security work the way you live, so it stops being something you avoid and starts being something that just works for you.
<h2>Introducing LastPass Mobile Smart Scanner: Password management that works the way you do</h2>
Mobile Smart Scanner is an intelligent password scanner that's available only in LastPass.
Built directly into the LastPass mobile app, Smart Scanner lets you use your phone's camera to scan typed or handwritten passwords and turn them into ready-to-use password vault entries.

<img src="https://www.lastpass.com/-/media/6f2c7e5075444f1cbded0bd55aacac0f.png?h=560&amp;w=500" >&nbsp;

Simply:
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1">Open your LastPass mobile&nbsp;app.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1">Scan&nbsp;the&nbsp;credentials.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1">Review&nbsp;detected fields such as&nbsp;site, username, and&nbsp;password.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="4" data-aria-level="1">Save&nbsp;to&nbsp;your&nbsp;vault.</li>
</ul>
The credentials you save&nbsp;with Smart Scanner&nbsp;are&nbsp;fully&nbsp;functional&nbsp;entries&nbsp;that&nbsp;can&nbsp;be&nbsp;auto filled&nbsp;like&nbsp;your other stored&nbsp;credentials.
This means&nbsp;no more delays, errors, or&nbsp;missed&nbsp;accounts.
And since we know secure access requires trust, Smart Scanner works entirely on your device, so your scans stay private. Credentials and images aren't stored or sent to LastPass, and you stay fully in control at every step. The result is a seamless experience that prioritizes ease and trust.
<h2>Why Mobile Smart Scanner matters for your business</h2>
For organizations, the biggest challenge with&nbsp;Secure Access&nbsp;is adoption.
Mobile Smart Scanner addresses this by removing the friction that prevents&nbsp;your&nbsp;employees from getting started.
<h3>Built for trust, designed for ease</h3>
Employees often store credentials in&nbsp;apps, spreadsheets, or even on paper. Smart Scanner&nbsp;makes it fast and easy to migrate&nbsp;those credentials into an&nbsp;encrypted&nbsp;vault.
<h3>Reduced&nbsp;IT burden</h3>
By simplifying credential&nbsp;management,&nbsp;you&nbsp;can reduce password reset requests. Smart Scanner makes secure behavior the easiest behavior,&nbsp;so&nbsp;your IT team&nbsp;can focus on&nbsp;mission-critical tasks.&nbsp;
<h3>Stronger&nbsp;Zero Trust foundation</h3>
In a Zero Trust approach, visibility is everything. Smart Scanner&nbsp;ensures&nbsp;every login is captured and secured.
<h3>Built for how people&nbsp;actually work</h3>
Smart Scanner was designed to meet users where they are,&nbsp;whether that&rsquo;s handwritten notes&nbsp;or&nbsp;printed documents.
Whether&nbsp;you&rsquo;re&nbsp;new to LastPass or finally bringing every password into one place, Mobile Smart Scanner helps you spend less time setting up&nbsp;and more time enjoying&nbsp;secure&nbsp;access to your digital life.
<h2>Simplify security without compromise</h2>
Mobile Smart Scanner is&nbsp;now&nbsp;currently available to all customers, including business users.
This means&nbsp;your business will be able to equip teams with a faster, more intuitive way to adopt&nbsp;secure&nbsp;access&nbsp;from&nbsp;day&nbsp;one.
So, go ahead.&nbsp;Scan. Save. Secure.&nbsp;Mobile Smart Scanner removes one of the last barriers to&nbsp;secure&nbsp;access, so every credential is protected from the very start.
<a rel="noopener noreferrer" href="https://blog.lastpass.com/posts/secure-access-essentials" target="_blank"><button class="lp-button lp-button--primary">Learn more about Secure Access Essentials</button></a>

LastPass Mobile Smart Scanner: Secure Access Made Simple

<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1">Mobile Smart Scanner&nbsp;is an intelligent password scanner that&nbsp;removes the biggest barrier to&nbsp;using password managers: Getting credentials into a secure vault.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1">Mobile Smart Scanner is now generally available to all customers, including business users.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1">This new capability&nbsp;is designed to&nbsp;improve employee adoption&nbsp;and accelerate time-to-value.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="4" data-aria-level="1">Mobile Smart Scanner is exclusive to LastPass,&nbsp;giving you the ability to scan&nbsp;credentials&nbsp;into fully usable, autofill-ready vault entries instantly.</li>
</ul>

Key takeaways: Mobile Smart Scanner

Capturing passwords just got easier. LastPass Mobile Smart Scanner lets you scan credentials with your phone's camera and save them directly to your vault.

Removing the First Barrier to Secure Access: LastPass Mobile Smart Scanner

Your 2026 AI security playbook

&nbsp;
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="5" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="1" data-aria-level="1">"What used to take weeks to craft can now be&nbsp;auto generated&nbsp;in a matter&nbsp;of seconds."&nbsp;~&nbsp;Guillermo Triana, CEO, PEO-Marketplace.com.&nbsp;&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="5" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="2" data-aria-level="1">"The&nbsp;danger&nbsp;is&nbsp;rolling out AI without having protections built around it."&nbsp;~&nbsp;Rafay Baloch, CEO, REDSECLABS&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="5" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="3" data-aria-level="1">"The attack surface&nbsp;isn&rsquo;t just&nbsp;your laptop&nbsp;but also&nbsp;the tokens and permissions you're handing your&nbsp;agents. A single over-scoped key can do more damage than a phishing&nbsp;email."&nbsp;~&nbsp;Hayat Amin, fractional CFO with&nbsp;20 years in high-tech growth &amp; 3 FT100 listings&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="5" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="4" data-aria-level="1">"API keys and service account passwords stored in workflow configs are an&nbsp;underappreciated vulnerability."&nbsp;~&nbsp;Roland Jakob, founder of Praxica.io.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="5" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="5" data-aria-level="1">"Most small business owners don't need the most expensive enterprise tools. What they need is a&nbsp;password manager,&nbsp;MFA&nbsp;enabled everywhere, and regular backups.&nbsp;These&nbsp;three things stop 90% of the attacks we see."&nbsp;~&nbsp;Peter Nguyen, founder of Protect My Data.&nbsp;&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="5" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="6" data-aria-level="1">&nbsp;"The companies that will be most successful are the ones that treat access management as part of the rollout from day one."&nbsp;~&nbsp;Cache Merrill, founder of&nbsp;Zibtek.&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="5" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="7" data-aria-level="1">LastPass surfaces your SaaS &amp; AI usage without requiring a manual audit or more staff. Once you see&nbsp;what's&nbsp;in use, you can vault credentials, enforce MFA, and apply the same access controls you already have for approved tools. Discovery is where&nbsp;governance&nbsp;starts.&nbsp;</li>
</ul>

What to know before you read

FAQs: 2026 AI security playbook

Discover the hidden access control gaps in AI apps and how to secure your SaaS and AI tools with credential management, MFA, and continuous SaaS discovery.

Your 2026 AI App Security Playbook: Industry Experts on the Access Control Gaps Most Teams Are Missing

<div style="border-left: 4px solid #003366; background-color: #f5f5f5; padding: 20px; margin: 20px 0;">
What&rsquo;s&nbsp;new&nbsp;at a glance:
June&nbsp;2026&nbsp;updates (Android)
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{'335552541':1,'335559683':0,'335559684':-2,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1">Cleaner, more intuitive autofill interface&nbsp;</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{'335552541':1,'335559683':0,'335559684':-2,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1">Improved&nbsp;settings&nbsp;navigation and fewer interruptions with Experience Previews</li>
</ul>
December 2025&nbsp;updates&nbsp;(iOS and Android)
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{'335552541':1,'335559683':0,'335559684':-2,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1">iOS: Fill Any Item (autofill more than passwords)</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{'335552541':1,'335559683':0,'335559684':-2,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1">iOS: Autofill TOTP (no more copying &amp; pasting OTP codes)</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{'335552541':1,'335559683':0,'335559684':-2,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1">Android:&nbsp;Add Password (without leaving autofill flow)</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="2" data-list-defn-props="{'335552541':1,'335559683':0,'335559684':-2,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="4" data-aria-level="1">Android:&nbsp;Open Vault (directly from the autofill menu)</li>
</ul>
</div>
At LastPass, we believe&nbsp;secure&nbsp;logins&nbsp;should&nbsp;never slow you down. Andwith every&nbsp;improvement,we&rsquo;re&nbsp;making&nbsp;your experience&nbsp;even&nbsp;more&nbsp;seamless.
Today,&nbsp;we&rsquo;re&nbsp;excited to share&nbsp;new updates&nbsp;for&nbsp;Android, along&nbsp;with interface improvements&nbsp;designed around&nbsp;one important&nbsp;goal:Simplification.&nbsp;
It&rsquo;s&nbsp;another way&nbsp;we&rsquo;re&nbsp;making&nbsp;secure&nbsp;access&nbsp;effortless for you.
<div class="button-container"><a href="https://www.lastpass.com/trial/business"><button class="lp-button lp-button--primary">Try Business</button></a><a href="https://lastpass.com/create-account.php?premium=1"><button class="class lp-button--red-outline">Try Personal</button></a></div>
<h2>New update:&nbsp;a&nbsp;cleaner, more intuitive autofill&nbsp;for&nbsp;Android&nbsp;(June 2026)</h2>
Instead of navigating through multiple layers of options, you can&nbsp;now&nbsp;choose&nbsp;your&nbsp;own&nbsp;<a href="https://www.lastpass.com/features/autofill/android">autofill</a>&nbsp;experience. You can also&nbsp;integrate with&nbsp;<a href="https://www.lastpass.com/features/autofill/google-chrome">Chrome</a>, which will provide seamless cross-device&nbsp;syncing&nbsp;and consistent autofill&nbsp;across&nbsp;apps.
Experience Previews&nbsp;lets you see exactly how inline autofill will behave,&nbsp;right in&nbsp;your settings. If you choose this autofill&nbsp;option,&nbsp;you&rsquo;ll&nbsp;see your vault items in a row above your keyboard, meaning when&nbsp;you&rsquo;re&nbsp;logging in across&nbsp;sites and apps:
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1">You can choose the right&nbsp;account instantly, without having to&nbsp;look for it.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1">You&nbsp;don&rsquo;t&nbsp;have to switch screens.&nbsp;</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-listid="3" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1">You can tap and fill instantly without breaking your flow.&nbsp;</li>
</ul>
We&rsquo;ve&nbsp;also updated legacy autofill, so it no&nbsp;longer pops up automatically.
With fewer disruptions and a more thoughtful layout,&nbsp;it&rsquo;s&nbsp;easier than ever to configure autofill exactly how you want it.
<h2>Other recentupdates&nbsp;(December 2025)</h2>
Previously released features introduced key improvements&nbsp;across&nbsp;iOS&nbsp;and Android.
<h3>&ldquo;Fill Any Item&rdquo; &amp; &ldquo;Autofill TOTP&rdquo;&nbsp;(iOS)</h3>
Two&nbsp;features&nbsp;are designed to make your experience easier and safer&nbsp;in&nbsp;<a href="https://www.lastpass.com/features/autofill/iphone">iOS</a>:Fill Any Item&nbsp;and&nbsp;Autofill TOTP&nbsp;(Time-Based One-Time Password).
<h3>Fill Any Item</h3>
On&nbsp;<a href="https://developer.apple.com/documentation/Security/password-autofill">iOS</a>, users can&nbsp;long&nbsp;press&nbsp;a text field to&nbsp;access the native autofill menu.&nbsp;
Until now,&nbsp;this&nbsp;native shortcut&nbsp;wasn&rsquo;t&nbsp;supported&nbsp;in&nbsp;LastPass.
That all changes with&nbsp;our new&nbsp;Fill Any Item&nbsp;feature.&nbsp;
Now, when you&nbsp;long&nbsp;press&nbsp;on a&nbsp;login field,&nbsp;the standard iOS autofill flow will work correctly with LastPass.&nbsp;Even better,&nbsp;you&rsquo;ll&nbsp;be able to autofill items beyond passwords, like addresses and payment cards.
LastPass will&nbsp;also&nbsp;automatically&nbsp;move&nbsp;you&nbsp;between fields,&nbsp;so you&nbsp;don&rsquo;t&nbsp;have to manually tap or copy/paste each field.
To get started, a&nbsp;quick three-screen guide appears the first time you open your&nbsp;vault,&nbsp;and anytime you add&nbsp;a new item,&nbsp;so you can confidently move forward without missing a step.
<h3>Autofill TOTP</h3>
For the first time, LastPass Business customers&nbsp;can&nbsp;also&nbsp;Autofill TOTPs (Time-Based One-Time Passwords).&nbsp;
No more opening the app, copying the code, and pasting it manually.&nbsp;
Whether&nbsp;you&rsquo;re&nbsp;using the keyboard or&nbsp;long&nbsp;pressing&nbsp;Fill Any Item&nbsp;feature, LastPass will streamline the process so you can log in faster and more securely.
<h3>Add Password and Open Vault&nbsp;(Android)</h3>
On Android,&nbsp;we&nbsp;rolled out&nbsp;new&nbsp;improvements designed to give you more control right from the autofill context menu.&nbsp;&nbsp;
<h4>Add Password</h4>
Sometimes, LastPass&nbsp;can&rsquo;t&nbsp;suggest the right credential because it&nbsp;isn&rsquo;t&nbsp;yet in your vault.
With this update,&nbsp;you can&nbsp;manually add a new password without leaving the autofill flow.&nbsp;
This&nbsp;means fewer interruptions and more flexibility&nbsp;as you&nbsp;capture credentials.
<h4>Open Vault</h4>
We&rsquo;ve&nbsp;also made it easier to navigate to your vault from the autofill menu.&nbsp;
If the suggested credentials&nbsp;don&rsquo;t&nbsp;match what you need, simply select &ldquo;Open Vault&rdquo; to search and choose the right item.&nbsp;
No more toggling back and forth between apps.&nbsp;
<h2>A better mobile experience is here</h2>
With&nbsp;our latest&nbsp;updates,&nbsp;you&rsquo;re&nbsp;in control of how LastPass works on your device.
From our newest Android enhancements to earlier&nbsp;improvements, these updates are designed to make&nbsp;logins easier and safer&nbsp;wherever you use LastPass.
We handle the complexity behind the scenes.&nbsp;
You&nbsp;get&nbsp;fewer interruptions, more flexibility, and a&nbsp;smoother path to secure&nbsp;access every time.
<div class="button-container"><a href="https://www.lastpass.com/trial/business"><button class="lp-button lp-button--primary">Try Business</button></a><a href="https://lastpass.com/create-account.php?premium=1"><button class="class lp-button--red-outline">Try Personal</button></a></div>
&nbsp;

Autofill Gets Even Better on Mobile: New iOS and Android Updates

We’re excited to share new autofill improvements coming to both iOS and Android designed to save you time and reduce friction. 

Emily Calo

Senior Product Marketing Manager

What’s New in LastPass Mobile Autofill 

AI Agent Access Control: The Missing Layer in 2026

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">73% of organizations have deployed AI tools, but only 7% are governing how those tools access corporate systems, creating a significant security gap.&nbsp;</li>
 <li class="li1" style="margin: 0px;">Attackers are now exploiting vulnerabilities before they're even publicly disclosed. Mandiant's M-Trends 2026 puts the mean time to exploit at negative seven days, while the average organization takes 43 days to patch. That gap is where your exposure lives.&nbsp;</li>
 <li class="li1" style="margin: 0px;">AI agents don't authenticate the way your employees do. They skip MFA, reuse credentials, and retain persistent access, leaving open access paths for attackers to exploit.&nbsp;</li>
 <li class="li1" style="margin: 0px;">A fully patched system can still be breached through a valid credential. CTEM solutions like the Qualys Enterprise TruRisk platform address the software vulnerability layer within a unified risk model, but the identity and access layer is a separate domain requiring its own dedicated solution.&nbsp;</li>
 <li class="li1" style="margin: 0px;">88% of organizations can't distinguish between personal and corporate AI accounts, and only 6% can see their full AI pipeline, which means most IT teams are being held accountable for risk they have no visibility into.&nbsp;</li>
 <li class="li1" style="margin: 0px;">Closing the identity and access gap doesn't require a complex identity stack. LastPass lets you surface shadow SaaS and AI usage automatically and implement secure access for every login.&nbsp;</li>
</ul>

FAQs: AI agent access control risks

AI agents skip MFA and reuse credentials, opening access paths attackers exploit. See why CTEM isn't enough and how to close the identity gap with LastPass.

AI Agent Access Control in 2026: Why Identity Governance + Continuous Exposure Management Must Work Together

AI Phishing, Vishing & Deepfakes: Your Biggest Credential Risk in 2026

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Voice phishing incidents increased 442% in Q2 2024, with momentum continuing into 2026.&nbsp;</li>
 <li class="li1" style="margin: 0px;">AI voice cloning now requires only a few seconds of audio from a podcast, video, or social media clip.&nbsp;</li>
 <li class="li1" style="margin: 0px;">It&rsquo;s become increasingly harder to tell a cloned voice from a real one.&nbsp;</li>
 <li class="li1" style="margin: 0px;">Bot scams can continuously target your entire employee directory. Due to automation, these scams require no manual efforts to sustain.&nbsp;</li>
 <li class="li1" style="margin: 0px;">Viral AI trends like the 2026 ChatGPT caricature craze are an active corporate security risk. When employees upload photos to create AI versions of themselves, that data can be used to build more convincing deepfake profiles targeting your organization.&nbsp;</li>
 <li class="li1" style="margin: 0px;">Weak, reused, or unmanaged credentials across your SaaS and AI ecosystem are the #1 target of AI-powered social engineering.&nbsp;</li>
 <li class="li1" style="margin: 0px;">You don&rsquo;t need an enterprise security budget to close the credential gap. SaaS visibility, FIDO2 MFA, and encrypted vaults are still the baseline that makes all other defenses more effective.&nbsp;</li>
</ul>

FAQs: AI phishing, vishing, and deepfakes

Learn how multi-channel AI attacks work and how to close the credential gap before they reach your team.

Multi-Channel AI Phishing Detection: Why Bot Scams and Voice Deepfakes Are Your Biggest Credential Risk in 2026

LastPass continues to set the standard in secure access, earning&nbsp;72&nbsp;badges&nbsp;in G2&rsquo;s Summer 2026 Grid Reports. Building on strong momentum from Spring, this latest recognition reinforces our leadership in delivering the essential tools businesses need to protect against credential misuse, shadow IT, and emerging AI security risks.&nbsp;
G2&rsquo;s quarterly reports spotlight industry-leading software based on verified customer feedback. These accolades reflect the real-world experiences of LastPass customers, captured through detailed G2 reviews, making this recognition a powerful testament to the value and trust we deliver every day.&nbsp;
<h2>Key achievements from&nbsp;G2&rsquo;s&nbsp;Summer&nbsp;2026&nbsp;Grid Reports&nbsp;</h2>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;134225954&quot;:true,&quot;134225961&quot;:true,&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="1" data-aria-level="1">Password Management: Leader, Small-Business<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335557856&quot;:16777215,&quot;335559685&quot;:720,&quot;335559737&quot;:0,&quot;335559738&quot;:300,&quot;335559739&quot;:0,&quot;335559740&quot;:279,&quot;335559991&quot;:360}">&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;134225954&quot;:true,&quot;134225961&quot;:true,&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="2" data-aria-level="1">Passwordless&nbsp;Authentication: Best Results<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335557856&quot;:16777215,&quot;335559685&quot;:720,&quot;335559737&quot;:0,&quot;335559738&quot;:300,&quot;335559739&quot;:0,&quot;335559740&quot;:279,&quot;335559991&quot;:360}">&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;134225954&quot;:true,&quot;134225961&quot;:true,&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="3" data-aria-level="1">Biometric Authentication: Best Estimated ROI Small-Business ROI&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;134225954&quot;:true,&quot;134225961&quot;:true,&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="4" data-aria-level="1">Password Managers:&nbsp;Momentum&nbsp;Leader&nbsp;</li>
</ul>
<ul>
<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;134225954&quot;:true,&quot;134225961&quot;:true,&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="5" data-aria-level="1">Single Sign-On (SSO): Most Implementable, Small-Business&nbsp;&nbsp;</li>
</ul>
<a href="https://www.lastpass.com/">LastPass</a>&nbsp;users&nbsp;consistently highlight its ease of use, cross-platform reliability, and strong security and access controls &mdash; from intuitive setup and seamless integrations to the confidence of knowing sensitive data is protected.&nbsp;Here&rsquo;s&nbsp;what customers are saying about their experience:&nbsp;
LastPass is so straightforward, where setting it is user friendly and it works efficiently on mobile apps and browser extensions. LastPass creates a robust password security system,&nbsp;and&nbsp;no&nbsp;one&nbsp;can access clients or&nbsp;users'&nbsp;data. The process of password generation with autofill capabilities is something the software does efficiently. The program&nbsp;operates&nbsp;smoothly in multiple&nbsp;platforms&nbsp;and this includes mobile, desktop and even browsers&nbsp;-&nbsp;<a href="https://www.g2.com/products/lastpass/reviews/lastpass-review-12746612">Rinalon E.</a>&nbsp;
LastPass is&nbsp;a very effective&nbsp;platform for saving client information without worrying about losing it. I find it easy to trust and feel confident using it. The User Interface is very friendly according to&nbsp;day to day&nbsp;activities and usage. We can also integrate with other&nbsp;softwares&nbsp;and bring in the information from&nbsp;previous&nbsp;vaults.&nbsp;-&nbsp;<a href="https://www.g2.com/products/lastpass/reviews/lastpass-review-12694317">Deepak L.</a>&nbsp;
As an IT organization,&nbsp;it's&nbsp;important for us to ensure the passwords we use to access our systems and intellectual property are secure. Also, having an audit trail is useful, especially in litigation, to show who accessed what.&nbsp;Additionally, the ability to move passwords between accounts, allowing them to survive employee termination, adds&nbsp;great value. LastPass was&nbsp;very easy&nbsp;to set up initially. Years ago, we just imported a CSV of our passwords, which made the&nbsp;process&nbsp;seamless.&nbsp;-&nbsp;<a href="https://www.g2.com/products/lastpass/reviews/lastpass-review-12647287">Jason H.</a><span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335557856&quot;:16711422,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:279}">&nbsp;
Ready to see why thousands of users trust LastPass?&nbsp;
<a href="https://www.g2.com/products/lastpass/reviews">Visit our G2 profile</a>&nbsp;to&nbsp;read more reviews and share your own experience with the LastPass&nbsp;community, and&nbsp;read about why LastPass was recently named in&nbsp;<a href="https://www.lastpass.com/company/newsroom/24500a8e-1421-42bf-9e9f-33b62ea7369c">G2&rsquo;s list of top security software in 2026</a>.<span data-ccp-props="{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335557856&quot;:16711422,&quot;335559738&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:279}">&nbsp;
About G2:&nbsp;G2&nbsp;is the world&rsquo;s largest and most trusted software marketplace. More than&nbsp;80 million people&nbsp;annually &mdash; including employees at&nbsp;all of&nbsp;the Fortune 500 &mdash; use G2 to make smarter software decisions based on authentic peer reviews.&nbsp;&nbsp;

LastPass Recognized as a G2 Leader in Password Management | Summer 2026 Grid Reports

Recognized with 72 G2 badges, LastPass leads in password management, SSO, and passwordless security — trusted by customers to stop credential misuse and AI risks.

LastPass Tops G2’s Summer 2026 Grid Reports as the #1 Small Business Password Manager

Allow, warn, block: AI governance for lean teams | LastPass

<ul>
 <li data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1">The 2026&nbsp;leaks from vibe code platforms like&nbsp;Lovable, Base44,&nbsp;and&nbsp;Replit&nbsp;weren't&nbsp;breaches but access control failures.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1">An "AI acceptable use policy" in your employee handbook is a good start.&nbsp;But without enforcement at the point of access,&nbsp;the policy&nbsp;carries no real authority.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1">The&nbsp;LastPass&nbsp;Allow/ Warn/ Block model gives&nbsp;your team&nbsp;a way to apply&nbsp;different levels&nbsp;of&nbsp;access&nbsp;control,&nbsp;without blanket restrictions that kill productivity or drive behavior underground.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="4" data-aria-level="1">Most AI risk starts at the credential&nbsp;rather than&nbsp;network layer.&nbsp;That's&nbsp;why governing access in the browser catches what&nbsp;enterprise&nbsp;CASB&nbsp;or SSPM tools&nbsp;miss.</li>
</ul>
<ul>
 <li data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="5" data-aria-level="1">LastPass Business Max surfaces&nbsp;every&nbsp;SaaS or&nbsp;AI tool&nbsp;your&nbsp;employees log into,&nbsp;while&nbsp;SaaS Protect&nbsp;enforces controls&nbsp;at the moment&nbsp;of access.</li>
</ul>

What to Know Before You Read 

Blanket AI bans don't reduce risk — they relocate it. See how allow, warn, block gives lean IT teams practical AI governance without enterprise overhead. 

Mike Kosak

Senior Principal Intelligence Analyst

Allow, Warn, Block: A Practical AI Governance Model for Lean Teams 

AI credential sprawl: Your guide to identity-first security

<div class="ListContainerWrapper SCXW68453381 BCX0" style="color: #000000; margin: 0px; padding: 0px;">
<ul class="BulletListStyle1 SCXW68453381 BCX0" role="list" style="margin: 0px; padding: 0px;">
 <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="1" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW68453381 BCX0" style="margin: 0px 0px 0px 24px;">
 To act autonomously, every AI agent your team onboards is issued credentials (API keys, OAuth tokens, SSH keys). And most teams struggle to maintain a complete inventory of agents and credentials.<span class="EOP Selected SCXW68453381 BCX0" data-ccp-props="{'134233117':false,'134233118':false,'201341983':0,'335559738':0,'335559739':0,'335559740':300}" style="background-color: #c6c6c6; margin: 0px; padding: 0px; border-color: #c6c6c6;">
 </li>
</ul>
</div>
<div class="ListContainerWrapper SCXW68453381 BCX0" style="color: #000000; margin: 0px; padding: 0px;">
<ul class="BulletListStyle1 SCXW68453381 BCX0" role="list" style="margin: 0px; padding: 0px;">
 <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="2" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW68453381 BCX0" style="margin: 0px 0px 0px 24px;">
 AI-assisted commits (saved snapshots of code changes) leak secrets at more than twice the rate of human-only commits.&nbsp;<span class="EOP Selected SCXW68453381 BCX0" data-ccp-props="{'134233117':false,'134233118':false,'201341983':0,'335559738':0,'335559739':0,'335559740':300}" style="background-color: #c6c6c6; margin: 0px; padding: 0px; border-color: #c6c6c6;">
 </li>
</ul>
</div>
<div class="ListContainerWrapper SCXW68453381 BCX0" style="color: #000000; margin: 0px; padding: 0px;">
<ul class="BulletListStyle1 SCXW68453381 BCX0" role="list" style="margin: 0px; padding: 0px;">
 <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="3" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW68453381 BCX0" style="margin: 0px 0px 0px 24px;">
 Don&rsquo;t hold that FIDO2 MFA rollout: While exploitation of vulnerabilities is now the #1 initial access vector (Verizon 2026 DBIR), credential abuse still sits in many attack paths.&nbsp;<span class="EOP Selected SCXW68453381 BCX0" data-ccp-props="{'134233117':false,'134233118':false,'201341983':0,'335551550':1,'335551620':1,'335559685':720,'335559737':0,'335559738':0,'335559739':0,'335559740':300,'335559991':360}" style="background-color: #c6c6c6; margin: 0px; padding: 0px; border-color: #c6c6c6;">
 </li>
</ul>
</div>
<div class="ListContainerWrapper SCXW68453381 BCX0" style="color: #000000; margin: 0px; padding: 0px;">
<ul class="BulletListStyle1 SCXW68453381 BCX0" role="list" style="margin: 0px; padding: 0px;">
 <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="4" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW68453381 BCX0" style="margin: 0px 0px 0px 24px; ">
 Frameworks like SOX, the UK Corporate Governance Code, and the EU AI Act require strong identity and access controls, which implicitly include non-human (machine) identities.&nbsp;<span class="EOP Selected SCXW68453381 BCX0" data-ccp-props="{'134233117':false,'134233118':false,'201341983':0,'335559738':0,'335559739':0,'335559740':300}" style="background-color: #c6c6c6; margin: 0px; padding: 0px; border-color: #c6c6c6;">
 </li>
</ul>
</div>
<div class="ListContainerWrapper SCXW68453381 BCX0" style="color: #000000; margin: 0px; padding: 0px;">
<ul class="BulletListStyle1 SCXW68453381 BCX0" role="list" style="margin: 0px; padding: 0px;">
 <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="5" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW68453381 BCX0" style="margin: 0px 0px 0px 24px; ">
 The fastest-growing identity threat is in the browser, where logins to AI-integrated apps live.<span class="EOP Selected SCXW68453381 BCX0" data-ccp-props="{'134233117':false,'134233118':false,'201341983':0,'335559738':0,'335559739':0,'335559740':300}" style="background-color: #c6c6c6; margin: 0px; padding: 0px; border-color: #c6c6c6;">
 </li>
</ul>
</div>
<div class="ListContainerWrapper SCXW68453381 BCX0" style="color: #000000; margin: 0px; padding: 0px;">
<ul class="BulletListStyle1 SCXW68453381 BCX0" role="list" style="margin: 0px; padding: 0px;">
 <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-list-defn-props="{'335552541':1,'335559685':720,'335559991':360,'469769226':'Symbol','469769242':[8226],'469777803':'left','469777804':'','469777815':'hybridMultilevel'}" data-aria-posinset="6" data-aria-level="1" role="listitem" class="OutlineElement Ltr SCXW68453381 BCX0" style="margin: 0px 0px 0px 24px;">
 LastPass gives lean IT teams: Real-time visibility into every SaaS and AI tool in use + centralized credential management + browser-level access controls.<span class="EOP Selected SCXW68453381 BCX0" data-ccp-props="{'134233117':false,'134233118':false,'201341983':0,'335559738':0,'335559739':0,'335559740':300}" style="background-color: #c6c6c6; margin: 0px; padding: 0px; border-color: #c6c6c6;">
 </li>
</ul>
</div>

FAQ: solving AI credential sprawl in real environments

AI tools create credentials faster than most teams can track. Learn what AI credential sprawl costs your business and how identity-first security helps.

Identity-first security for Financial Services: Your best defense against AI credential sprawl 

6 Shadow IT Solutions for Companies in 2026

A guide to finding the best shadow IT solution for your organization. Including solutions for small to midsize businesses, as well as enterprise level companies

6 Shadow IT Solutions for Companies in 2026 

One chapter in the saga of infostealer malware has ended&mdash;at least for now&mdash;after a global law enforcement takedown of Lumma Stealer in mid-May. US, European, and Japanese authorities, with the help of tech companies including Microsoft and Cloudflare, took down, suspended, and blocked approximately 2,300 malicious domains that made up part of the infostealer&rsquo;s backbone. The FBI also seized domains that served as login panels allowing other criminals to access and use the infostealer. Although, this seizure is intended to effectively prevent criminals from being able to access Lumma to compromise computers and steal data, the overall stealer threat will remain prevalent for the foreseeable future. 
(Interested in learning more about the infostealer threat outlook? Read the LastPass TIME team&rsquo;s threat predictions and analysis on <a href="https://blog.lastpass.com/posts/2025-cybersecurity-trends">what direction infostealers and other threats are heading</a>.) 
<h2>What is Lumma?</h2>
 
Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022. Since its initial release, Lumma&rsquo;s developers have released multiple upgraded versions of the software. Before the malware-as-a-service (MaaS) platform was dismantled, the FBI linked Lumma to around <a href="https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted">10 million infections</a> globally. Lumma&rsquo;s follow-on attacks involving stealing credentials, cryptocurrency data, and credit card information have resulted in an estimated <a href="https://cyberscoop.com/lumma-infostealer-widespread-victims/">$36.5 million USD</a> in credit card theft in 2023. The malware hit individuals and a wide range of industries, including Fortune 500 companies, airlines, universities, banks, and hospitals. 
What makes this stealer particularly effective is that it continues to evolve to bypass security layers even as defenders are responding to the threat. On top of grabbing browser-stored passwords and cookies, it&rsquo;s also capable of extracting autofill data, email credentials, File Transfer Protocol (FTP) data, and two-factor authentication tokens and backup codes. Using its MaaS platform, its creators sold access to the malware on multiple underground markets and platforms like Telegram. 
<h2>What comes next?</h2>
 
This takedown is a major win for law enforcement and will help disrupt the initial access broker ecosystem in the near term. However, this is an ecosystem that has demonstrated its resilience again and again. The number of existing infostealer families, the open access to numerous source codes of previous infostealers, and the constant demand create a lucrative environment with very low barriers to entry. Given the resiliency of this market, other infostealer will likely quickly step in and fill in the gaps left after the Lumma takedown. 
A similar pattern previously played out with other similar takedowns. On October 28, 2024, Operation Magnus disrupted the RedLine and META infostealers. RedLine was a significant stealer last year up until the takedown, after which Lumma grew in popularity and took over a portion of the market share previously held by RedLine. Redline infected 9.9 million hosts, or 43% of all infostealer infections observed by Flashpoint in 2024. The next four most-prolific infostealers in 2024, including RisePro, SteaC, Lumma Stealer, and Meta Stealer, infected a <a href="https://cyberscoop.com/infostealers-cybercrime-surged-2024-flashpoint/">combined 7 million hosts</a>. 
We expect to see something similar following the Lumma Stealer takedown operation. The disruption effect following takedown is real, but there are still some new infections and logs for sale that were likely stolen before the infrastructure was taken down. Additionally, just because Lumma&rsquo;s infrastructure was dismantled, a lot of the data it stole likely continues to live on the dark web&mdash;thanks to the cybercriminal ecosystem that resells this information. Additionally, <a href="https://blog.checkpoint.com/security/lumma-infostealer-down-but-not-out/">CheckPoint</a> reported Lumma&rsquo;s developers are already trying to rebuild and restart their operations, which may or may not be successful.&nbsp;As SpyCloud&rsquo;s <a href="https://www.linkedin.com/posts/thilligoss_lummatakedown-lummareallynowork-stealc-activity-7332888157480198146-u94p">Trevor Hilligoss shared</a>, daily new Lumma infections have trended downward following the takedown but not as much as expected. Continued monitoring will be necessary to determine the takedown&rsquo;s impact. 
Long-standing groups such as Vidar and Stealc are good examples of this, but other newer families, such as Acreed, will also be well positioned to increase their market share. <a href="https://www.bleepingcomputer.com/news/security/russian-market-emerges-as-a-go-to-shop-for-stolen-credentials/">ReliaQuests</a> already reported Acreed is rapidly gaining traction following the Lumma takedown. <a href="https://webz.io/dwp/acreed-infostealer-everything-we-know-so-far/">Over 4,000 logs</a> stolen by Acreed were reportedly uploaded to the Russian Market within its first week of operations.&nbsp;Nexus has also gained some traction over the last week in Lumma&rsquo;s absence. Further, former affiliates and/or administrators associated with Lumma itself may split off to create their own offerings.

<img src="https://static.lputil.com/-/media/ffef2d4ef9d544babc2169a6d0274059.jpg?h=310&amp;w=624" >&nbsp;
Daily new LummaC2 infections (Source: Trevor Hilligoss)
<h2>How to protect yourself against infostealers</h2>
The threat from infostealers will remain very real for the foreseeable future and continue to adapt. Oftentimes, stealers are used in indiscriminate campaigns. Additionally, the sheer volume of data that has been dumped on the internet is immense. That means anyone is fair game and should take action to protect themselves following that assumption that they could be targeted. 
<ul>
 <li>Use strong, unique passwords for every account. This will prevent credential stuffing attacks, which is a common tactic where threat actors insert stolen usernames and passwords. That way, if one password is exposed, it won&rsquo;t give access to all your other accounts where you reuse the same password. Also, consider using a password manager to securely and conveniently store them.</li>
 <li>Enable MFA on your accounts. While this measure isn&rsquo;t failproof on its own, it adds an additional layer of defense and makes you a harder target.</li>
 <li>Be on guard for phishing attempts. Infostealers often spread through phishing emails and malicious downloads. </li>
 <li>Check HaveIBeenPwned to monitor potential exposure if you&rsquo;re worried you may have been infected by an infostealer. </li>
</ul>

What the Lumma stealer takedown means for the infostealer market and your personal data

Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkey vs Password: Which is More Secure? | LastPass

FAQs: Passkey vs password

Explore the differences between passkeys and passwords. Learn how LastPass enhances security and simplifies access with advanced authentication methods.

Blog

Blog

Recent

News & Insights

Cybersecurity

Product Tutorials

Threat Intel

Product Updates

Tips And Tricks

Klue Supply Chain Incident & LastPass Response

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkeys Vs. Passwords: Which Login Method Is Safer in 2026?

Klue Supply Chain Incident & LastPass Response

Your 2026 Agentic AI Security Checklist: 10 Controls to Validate Before You Deploy

Subscribe & Save 20% off Premium or Families plans

Removing the First Barrier to Secure Access: LastPass Mobile Smart Scanner

Your 2026 AI App Security Playbook: Industry Experts on the Access Control Gaps Most Teams Are Missing

What’s New in LastPass Mobile Autofill

AI Agent Access Control in 2026: Why Identity Governance + Continuous Exposure Management Must Work Together

Multi-Channel AI Phishing Detection: Why Bot Scams and Voice Deepfakes Are Your Biggest Credential Risk in 2026

LastPass Tops G2’s Summer 2026 Grid Reports as the #1 Small Business Password Manager

Allow, Warn, Block: A Practical AI Governance Model for Lean Teams

Identity-first security for Financial Services: Your best defense against AI credential sprawl

6 Shadow IT Solutions for Companies in 2026