You might have seen <a href="https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024">this shocking prediction from Gartner:</a> by 2027, 75% of employees will acquire, modify or create technology outside IT&rsquo;s visibility &ndash; up from 41% in 2022.&nbsp;
Your employees rely on more SaaS tools than ever and not all of them are on your radar. &nbsp; 
From cloud apps and browser extensions to AI tools, today&rsquo;s workplaces move fast. And when anyone can implement a new app with little more than a credit card and a dream, you can be sure that very few of them are thinking about access or credential management. Consider this:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Shadow IT and Shadow AI are expanding the attack surface, with unsanctioned tools introducing security gaps no one&rsquo;s monitoring.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">App bloat is costing real money &mdash; small businesses now pay for an average of 134 unused applications, and large organizations pay for 473.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Sensitive data is slipping through the cracks, with 38% of employees admitting they&rsquo;ve shared work information with unauthorized AI tools.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Compliance is harder to maintain when there&rsquo;s no clear picture of who&rsquo;s accessing what, and from where.&nbsp;</li>
</ul>
Single sign-on (SSO) can help with your core apps-- the ones that you know about-- but it doesn&rsquo;t cover everything, especially those smaller, hidden apps. And for small and mid-sized businesses, controlling those can get expensive and time-consuming, fast.&nbsp;&nbsp;
That&rsquo;s where the security gaps start. Without a simple, customizable way to manage access, secure credentials and monitor app usage, it&rsquo;s easy to lose control. And that opens the door to risk from old accounts that still have access to sensitive info, to apps no one remembers signing up for.&nbsp;
It&rsquo;s no longer enough to secure passwords alone. Businesses need an approach to identity and access management that&rsquo;s as flexible, efficient, and user-friendly as the tools their employees actually use.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">What is Secure Access Experiences?&nbsp;&nbsp;</h2>
Secure Access Experiences is the LastPass answer to this growing access management crisis &mdash; an evolving approach designed to bring together essential capabilities into one intuitive experience. It helps you control who has access to what, based on your own policies &mdash; not just passwords. Whether your team is using approved tools or ones you didn&rsquo;t even know about, you&rsquo;ll get the visibility and control you need, all in one easy-to-use solution.&nbsp;
With Secure Access Experiences, you will be able to:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Log in with ease: Securely manage how your team stores and uses passwords. Support for passkeys makes logging in even faster and safer.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Control who gets access: Make sure the right people have access to the right apps, systems, and data&mdash;nothing more, nothing less. It&rsquo;s easy to set up and adjust as your business grows.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">See what&rsquo;s happening: Know which apps your team is using, when, and how. Stay informed, spot issues early, and feel confident that everything&rsquo;s running smoothly.&nbsp;&nbsp;&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Why do Secure Access Experiences matter?&nbsp;</h2>
As SaaS adoption grows and the lines between personal and professional tools blur, businesses need a smarter, simpler way to manage access &mdash; one that meets modern challenges head-on, without overwhelming teams or breaking the bank.&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Grows with your business: As your business adds more tools, people, and locations, LastPass makes it easy to keep everything secure without slowing you down.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Easy to manage, easier on your budget: Control access to all your tools from one place. Less hassle for you, and no need to invest in multiple systems.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Provides better protection, fewer headaches: Keep your business safe with strong, simple security&mdash;and make it easier to meet industry requirements along the way.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Simple for your team to use: When it&rsquo;s easy to use, your team actually uses it. That means stronger habits, less risk, and happier employees.&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">It starts with SaaS Monitoring and SaaS Protect.&nbsp;</h2>
You can&rsquo;t control what you can&rsquo;t see. The first capability in Secure Access Experiences was&nbsp;SaaS Monitoring. Now, SaaS Protect is available so that customers can take action on that visibility.&nbsp;&nbsp;&nbsp;
<img src="https://cdn.lputil.com/-/media/2b6fd9bba92346a8a0fcedeca39eed06.png?h=824&amp;w=1250" >
<p class="Paragraph SCXW34306727 BCX0" paraid="543943140" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{232}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">With SaaS Monitoring and SaaS Protect, business owners and IT admins can finally see what apps are being used across their organization, spot risky behavior, and make informed decisions about which apps to allow, restrict, or retire. helping them detect unapproved tools, spot Shadow IT and Shadow AI, and optimize application investments &mdash; all without the need to deploy extra agents, integrations, or complexity.
<p class="Paragraph SCXW34306727 BCX0" paraid="713470910" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{238}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">The future of easier visibility and control is here. Start your Secure Access Experiences journey today.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>

Introducing Secure Access Experiences: Controlling the Chaos of Modern App Sprawl

Secure Access Experiences is the LastPass answer to this growing access management crisis.

Get LastPass Free

Create and store secure passwords for yourself, your team or business.

Why LastPass?

Remember fewer passwords and log in faster with our browser extension.

How LastPass works

LastPass zero-knowledge security model keeps your data private even from us.

Security Architecture

Compare LastPass competitors, plans, and features in one place

Compare LastPass

Overview

Password management

Save and autofill

Password generator

Password sharing

Passkeys

Dark web monitoring

Security dashboard

Key Features

Free LastPass Premium trial, no credit card required.

Free LastPass Business trial, no credit card required.

Let our experts help you find the right plan and successfully deploy LastPass.

Sync passwords across all devices, monitor password health, data breaches and much more.

Personal

Premium password management for family or group of 6 people.

Families

Personal Plans

Password vault

Save & autofill

Automatic device sync

Emergency access

Personal password sharing

FOR INDIVIDUALS

30-day free LastPass Premium trial, no credit card required.

30-day free LastPass Families trial, no credit card required.

Limited to 1 device type and basic password management features.

Designed for businesses of all sizes, from small startups to enterprises.

Business

Simplify secure access straight from the browser with more admin control

Business Max

For single teams just getting started with password management.

Teams

Designed to keep your clients' credentials protected and private.

Business Plans

User management

SaaS Monitoring

SaaS Protect

Business sharing

Multifactor Authentication

Integrations

Single Sign-on

Identity management

For admins

Marketing teams

Legal teams

HR teams

Business leaders

IT admins

Solutions by role

Case studies

Webinars

Product demos

Events

Trust Center

Compliance Center

Security architecture

LastPass University

Resource Center

Pricing

Join the LastPass Partner Program to provide even more value to your customers.

Partner program overview

Managed Service Providers

Resellers

Cloud marketplaces

Technology Alliance Partners

LastPass Partner Program

Grow new revenue streams by meeting customer's security needs.

Looking for help or interested in becoming a LastPass partner? Get in touch with our partner team.

Connect with trusted LastPass Partners to support your security needs.

Partners

Self-service library of resources and guides for all LastPass products.

Support Center

Community forum

System status

Help

Personal support for all LastPass’ subscribed customers.

Support

Get LastPass free

Submit sales inquiry

Call sales

Request a demo

Find a partner

Contact sales

Log in

“People are experimenting with AI tools like OpenAI and Canva. We don’t want to block innovation, but we do want to guide it safely. LastPass is smart, secure, and it just works.” 

Prompt injection attacks in 2025

Security researcher Johann Rehberger is the leading voice warning about AI prompt injections.&nbsp;
The age of "Prompt Injection 2.0" has arrived, combining natural language tactics with new multimodal exploits to create a hybrid menace for AI.&nbsp;
The real nightmare is autonomous propagation, which can infect an entire AI system without human input.&nbsp;
CaMel isn't a hump-backed mammal. It's how Google DeepMind is turning prompt injection defense into a science.&nbsp;
Access control via LastPass SaaS Monitoring + SaaS Protect serves as a frontline defense, blocking risky apps and reducing the attack surface.&nbsp;

Key takeaways: Prompt injection

FAQs: Prompt injection

The age of “Prompt Injection 2.0” has arrived, combining natural language tactics with new multimodal exploits to create a hybrid menace for AI. 

Prompt Injection Attacks in 2025: When Your Favorite AI Chatbot Listens to the Wrong Instructions

7 best password managers for non-technical teams in 2025

FAQs about password managers for non-technical teams

. LastPass stands out with its user-friendly interface and top-notch security for non-technical teams.

7 Best Password Managers for Non-Technical Teams in 2025

Possible CryptoChameleon Social Engineering Campaign Targeting LastPass Customers, Crypto Exchange Customers, Passkeys, and More

LastPass would like to alert our customers of a current phishing campaign that began in mid-October targeting our users, which has been associated with crypto theft.

6 best 1Password alternatives in 2025

FAQs about 1Password alternatives

LastPass is a great contender because it creates strong passwords that keep your accounts secure while keeping everything simple and straightforward.

What is browser hijacking and why your search results can’t be trusted

The first widely recognized browser hijacker was CoolWebSearch,&nbsp;which compromised 8.2% of computers worldwide.&nbsp;
You open a tab and search, but someone else decides what you see. Browser hijackers can track your every move, reroute your searches, and flood your screen with unwanted content.&nbsp;Discover what's really controlling your search results.&nbsp;
Strange browser settings, slow page loads, and frequent redirects to unfamiliar sites? You may have a browser hijacker on your hands.&nbsp;
You've spotted the signs. Now, the fix starts with running a reputable antivirus (but doesn't end there).&nbsp;
LastPass complements tools like TotalAV to give you a layered defense. Uncover the tools you need to fight back against browser hijackers.&nbsp;

Key takeaways: Browser hijacker

FAQs: How to remove browser hijackers

Browser hijackers can track your every move, reroute your searches, and flood your screen with unwanted content.

What Is Browser Hijacking and Why Your Search Results Can’t Be Trusted

Packet sniffing in cyber espionage 

Packet sniffing is essentially eavesdropping, which can be weaponized by the most dangerous threat groups in the world.&nbsp;
Packet sniffing can be legal -- sometimes.&nbsp;
The new foot soldiers of cyber espionage are getting younger.&nbsp;
Protecting against packet sniffing takes a multi-layered, defense-in-depth approach.
Along with complementary industry tools, LastPass Business Max can help stop rogue logins and protect your most sensitive data.&nbsp;

Key takeaways: Packet sniffing

Packet sniffing – the silent interception of network data – is increasingly leveraged in cyber spying, especially for stealing credentials. 

Undercover Bytes: Packet Sniffing in Cyber Espionage 

The rise and reign of computer worms

Stuxnet was no ordinary worm; it changed the course of history as the first worm used for geopolitical warfare.
In 1988, a graduate student released the world's first worm, and no one expected him to do it.&nbsp;
Worm infections aren't just ordinary annoyances. Any of ten (10) warning signs could mean your home or business office is under attack.&nbsp;
Worms thrive by exploiting vulnerabilities. A defense-on-depth approach seals every weak entry point.&nbsp;
Along with complementary industry tools, LastPass SaaS Monitoring, SaaS Protect, and FIDO2MFA helps you outsmart worm threats, old and new.&nbsp;

Key takeaways: Computer worm

A computer worm is self-replicating malware that doesn’t need a host file to spread.  

The Rise and Reign of Computer Worms: Inside the Battle for Control

LastPass would like to alert our customers of a current phishing campaign that was detected today, October 13, 2025. These phishing emails are being sent from the email addresses &ldquo;hello@lastpasspulse[.]blog&rdquo; or "hello@lastpassgazette[.]blog" with the subject line &ldquo;We Have Been Hacked - Update Your LastPass Desktop App to Maintain Vault Security.&rdquo; To be clear, LastPass has NOT been hacked, and this is an attempt on the part of a malicious actor to draw attention and generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails.&nbsp;
The below image displays the body of the email and the link purporting to take potential victims to a new desktop app site, which will instead direct victims to a phishing site hosted at &ldquo;lastpassdesktop[.]com" or "lastpassgazette[.]blog."&nbsp;The threat actor also registered a similar site (&ldquo;lastpassdesktop[.]app&rdquo;), potentially for use in future iterations of this campaign. Other indicators of malicious behavior associated with this campaign include the threat actors&rsquo; use of known bulletproof host NICENIC to host the phishing site, as well as the timing of the campaign, which falls over a holiday weekend in the United States, which is a common tactic among threat actors seeking to take advantage of reduced staffing under the assumption it will postpone detection and draw out response time.
<img src="https://www.lastpass.com/-/media/e0ec8593a81c4645b68ec05c71b653ef.png?h=470&amp;w=1006" >
Please remember that no one at LastPass will ever ask for your master password. Rest assured, we are working to have this domain taken down as soon as possible and at the time of publication, Cloudflare has posted warning pages in front of the site advising visitors that these sites are phishing pages. Please take the appropriate precautions and, as always, if you are ever unsure whether a LastPass branded email is legitimate, please submit it to <a href="mailto:abuse@lastpass.com">abuse@lastpass.com</a>. &nbsp;
Malicious URLs and associated IPs:&nbsp;&nbsp;
<ul>
 <li class="li3" style="color: #211f1f; margin: 0px;">&ldquo;lastpassdesktop[.]com&rdquo;&nbsp;
 <ul>
 <li class="li3" style="color: #211f1f; margin: 0px;">Serving IP address at time of publication: 172.67.147[.]36&nbsp;</li>
 </ul>
 </li>
</ul>
<ul>
 <li class="li3" style="color: #211f1f; margin: 0px;">&ldquo;lastpassdesktop[.]app&rdquo;&nbsp;
 <ul>
 <li class="li3" style="color: #211f1f; margin: 0px;">Serving IP address at time of publication: 172.67.219[.]2&nbsp;</li>
 </ul>
 </li>
</ul>
<ul>
 <li class="li3" style="color: #211f1f; margin: 0px;">"lastpassgazette[.]blog"
 <ul>
 <li class="li3" style="color: #211f1f; margin: 0px;">Serving IP address at time of publication:&nbsp;84.32.84[.]32</li>
 </ul>
 </li>
</ul>
Header information:&nbsp;
From: LastPass hello@lastpasspulse[.]blog&nbsp;
Associated IPs:&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: #211f1f; margin: 0px;">148.222.54[.]15&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: #211f1f; margin: 0px;">23.83.222[.]47&nbsp;</li>
</ul>
Reply-to: hello@lastpasspulse[.]blog&nbsp;
Subject: We Have Been Hacked - Update Your LastPass Desktop App to Maintain Vault Security&nbsp;&nbsp;

New Phishing Campaign Leveraging LastPass Branding

LastPass would like to alert our customers of a current phishing campaign that was detected today, October 13, 2025.

October 13 Phishing Campaign Leveraging LastPass Branding 

Juice jacking in 2025

Juice jacking, the act of exploiting public USB charging stations to plant malware or steal data, isn’t your typical scam.

Juice Jacking in 2025: Want a Side of Malware with That Free Charge? 

Data exfiltration

Data exfiltration is the intentional, unauthorized transfer of data from a computer, network, or system to an external attacker-controlled server. 

How the Hunt for Markus Hess Launched Today’s Data Exfiltration Defenses 

The digital battlefield is witnessing a significant shift, with artificial intelligence (AI) rapidly becoming a critical tool for both cyber attackers and defenders. Credential harvesting, an effective method for gaining unauthorized access, is now being supercharged by AI, leading to more sophisticated, evasive phishing campaigns like the recent credential harvesting campaign Microsoft Threat Intelligence discovered. These developments raise the stakes for individuals and organizations defending against identity-based threats. Read on to learn more.
<h3>Why AI-Enhanced Phishing Matters</h3>
The rise of AI-enhanced phishing campaigns poses new challenges to existing cybersecurity defenses, elevating the threats to individuals and organizations alike. 
<ul>
 <li>Increased effectiveness and evasion: The growing adoption of AI enables threat actors to create more sophisticated, evasive, and effective attacks. When utilized in credential-focused attacks, this technology increases the risk of identity-based threats. </li>
 <li>Lowering the barrier to entry: AI tools are lowering the technical bar for cybercriminals. Hackers with limited coding experience can now launch attacks, taking this capability from the hands of a smaller pool of advanced threat actors down to script kiddies&rsquo; level and everyone in between. For instance, attackers can use Fraud-as-a-Service toolkits, available on platforms like Telegram for $10 per week, to launch large-scale account takeovers by leveraging AI-powered phishing campaigns and automated bots that can <a href="https://abnormal.ai/blog/atlantis-aio-credential-stuffing-140-platforms">test millions of stolen credentials per hour</a>. </li>
 <li>Need for AI-powered defense: To fight AI, you can use AI. Harnessing this technology to fight back can enable defenders to detect and defend against these sophisticated attacks by analyzing a broader range of signals which are less susceptible to AI-created obfuscation. Additionally, AI-generated obfuscation can leave behind synthetic artifacts, like wordy naming or unnatural encoding schemes that can become new detection signals. </li>
 <li>Increased risk of account takeovers and business email compromise (BEC): Compromised credentials are one of the most common and effective methods used for initial access, accounting for <a href="https://www.ibm.com/thought-leadership/institute-business-value/report/2025-threat-intelligence-index">almost a third of global cyberattacks</a>. So, it&rsquo;s no surprise that attackers continue targeting credentials to resell them on the dark web or to enable follow-on activities like account takeovers and BEC attacks.</li>
</ul>
<h3>Microsoft Detects AI-Obfuscated Phishing Campaign </h3>
Microsoft Threat Intelligence recently detected and disrupted a credential harvesting campaign primarily targeting US-based organizations using AI-written code to create obfuscated and evasive payloads. The threat actor compromised a small business email account and then used it to distribute malicious phishing emails to steal credentials. The content of the email was crafted to resemble a file-sharing notification for a PDF document, even though the file extension was an SVG file. Upon opening, the SVG file redirected the victim to a webpage that prompted them to complete a CAPTCHA for verification. According to researchers, the campaign likely presented a fake sign in page after the CAPTCHA to harvest credentials, although their visibility past the initial landing page is limited because the activity was detected and blocked.
<img src="https://www.lastpass.com/-/media/9e8126df416f421084fbe6b442de8b61.png" >
Security verification prompt (Microsoft)
The SVG code reportedly used a unique method to hide its content and behavior by using business-related language to disguise its malicious activity, instead of using cryptographic obfuscation which is more commonly used to disguise phishing content. 
The click-fix social engineering tactic used here is also very common after growing in popularity over the last year and usually leads to information theft and data exfiltration. This technique attempts to trick users into running malicious commands on their devices by taking advantage of people&rsquo;s tendency to engage in seemingly benign interactions, like human verification and CAPTCHA checks. ClickFix relies on human intervention to launch the malicious commands, allowing these attacks to get past conventional, automated security solutions. 
<h3>AI vs. AI</h3>
As Alex Cox points out in this blog post detailing both <a href="https://blog.lastpass.com/posts/offense-defense-ai-in-cybersecurity">offensive and defensive uses of AI</a> in cybersecurity, &ldquo;With its capacity for rapid processing and learning, AI has become crucial in various sectors, including cybersecurity. However, AI can also be a tool for malicious cyber activities, creating a complex and ever-evolving security landscape.&rdquo; He outlines three potential applications of AI and machine learning (ML) in cyber defense: Anomaly Detection, Predictive Analytics, and Summarization. 
The silver lining of this report is that Microsoft&rsquo;s AI-powered defenses were able to defend against the AI-written malicious code by detecting an anomaly in how it was written and structured. Consulting Microsoft Security Copilot, researchers determined the code was synthetic and likely generated by an LLM or a tool using one. Security Copilot highlighted several indicators to support this conclusion: 
<ul>
 <li>Overly descriptive and redundant naming</li>
 <li>Modular and over-engineered code structure</li>
 <li>Generic comments</li>
 <li>Formulaic obfuscation techniques</li>
 <li>Unusual use of CDATA and XML declaration</li>
</ul>
<h3>More Case Studies</h3>
The campaign Microsoft identified highlights an increasing trend of threat actors using AI and LLMs to enhance credential harvesting campaigns. These campaigns use sophisticated tactics to evade detection and increase their chances of success. 
<ul>
 <li>Campaign Abusing Simplified AI Platform (July 2025):
 <ul>
 <li>Description: Cato Networks uncovered a campaign leveraging Simplified AI, a legitimate marketing platform, to steal Microsoft 365 credentials from US-based organizations. The attack started with emails impersonating executives from a global pharmaceutical distributor, containing password-protected PDF attachments. These PDFs linked to the Simplified AI platform, which was manipulated to display authentic company branding alongside Microsoft 365 imagery, ultimately redirecting victims to a convincing fake Microsoft 365 login portal.</li>
 <li>AI's Role: The campaign exploited users&rsquo; inherent trust in legitimate AI platforms to bypass security defenses, blending malicious activity within normal enterprise traffic.&nbsp;</li>
 <li>Impact: At least one US investment firm was successfully compromised before the campaign was contained.&nbsp;</li>
 </ul>
 </li>
</ul>
<ul>
 <li>Gamma AI Platform Abused for SharePoint Logins (April 2025):
 <ul>
 <li>Description: Threat actors exploited the Gamma AI presentation platform in phishing campaigns to steal Microsoft credentials via spoofed SharePoint login pages. Emails containing PDF document links ultimately redirected users to intermediate pages, including Cloudflare Turnstile CAPTCHA, before reaching a fake Microsoft SharePoint login portal. Adversary-in-the-middle (AiTM) techniques were used for real-time credential validation.&nbsp;</li>
 <li>AI's Role: The campaign leveraged a legitimate AI service to host phishing content, a tactic known as living-off-trusted-sites (LOTS), to evade standard email security checks.&nbsp;</li>
 </ul>
 </li>
</ul>
<h3>A Silver Lining for Security Teams</h3>
Attackers are adopting AI to enhance their phishing operations, such as creating more convincing lures, automating obfuscation, generating or tweaking code, and blending in with legitimate content. This makes phishing attacks more challenging to detect through traditional defenses. However, Microsoft&rsquo;s successful disruption efforts and new detection signals associated with AI-generated content demonstrate that these AI-driven threats can be defeated.

Credential Harvesting Landscape: AI Escalates the Arms Race

The digital battlefield is witnessing a significant shift, with artificial intelligence (AI) rapidly becoming a critical tool for both cyber attackers and defenders. Credential harvesting, an effective method for gaining unauthorized access, is now being supercharged by AI, leading to more sophisticated, evasive phishing campaigns like the recent credential harvesting campaign Microsoft Threat Intelligence discovered. These developments raise the stakes for individuals and organizations defending against identity-based threats.

The Evolving Landscape of Credential Harvesting: AI Escalates the Arms Race

One chapter in the saga of infostealer malware has ended&mdash;at least for now&mdash;after a global law enforcement takedown of Lumma Stealer in mid-May. US, European, and Japanese authorities, with the help of tech companies including Microsoft and Cloudflare, took down, suspended, and blocked approximately 2,300 malicious domains that made up part of the infostealer&rsquo;s backbone. The FBI also seized domains that served as login panels allowing other criminals to access and use the infostealer. Although, this seizure is intended to effectively prevent criminals from being able to access Lumma to compromise computers and steal data, the overall stealer threat will remain prevalent for the foreseeable future. 
(Interested in learning more about the infostealer threat outlook? Read the LastPass TIME team&rsquo;s threat predictions and analysis on <a href="https://blog.lastpass.com/posts/2025-cybersecurity-trends">what direction infostealers and other threats are heading</a>.) 
<h2>What is Lumma?</h2>
 
Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022. Since its initial release, Lumma&rsquo;s developers have released multiple upgraded versions of the software. Before the malware-as-a-service (MaaS) platform was dismantled, the FBI linked Lumma to around <a href="https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted">10 million infections</a> globally. Lumma&rsquo;s follow-on attacks involving stealing credentials, cryptocurrency data, and credit card information have resulted in an estimated <a href="https://cyberscoop.com/lumma-infostealer-widespread-victims/">$36.5 million USD</a> in credit card theft in 2023. The malware hit individuals and a wide range of industries, including Fortune 500 companies, airlines, universities, banks, and hospitals. 
What makes this stealer particularly effective is that it continues to evolve to bypass security layers even as defenders are responding to the threat. On top of grabbing browser-stored passwords and cookies, it&rsquo;s also capable of extracting autofill data, email credentials, File Transfer Protocol (FTP) data, and two-factor authentication tokens and backup codes. Using its MaaS platform, its creators sold access to the malware on multiple underground markets and platforms like Telegram. 
<h2>What comes next?</h2>
 
This takedown is a major win for law enforcement and will help disrupt the initial access broker ecosystem in the near term. However, this is an ecosystem that has demonstrated its resilience again and again. The number of existing infostealer families, the open access to numerous source codes of previous infostealers, and the constant demand create a lucrative environment with very low barriers to entry. Given the resiliency of this market, other infostealer will likely quickly step in and fill in the gaps left after the Lumma takedown. 
A similar pattern previously played out with other similar takedowns. On October 28, 2024, Operation Magnus disrupted the RedLine and META infostealers. RedLine was a significant stealer last year up until the takedown, after which Lumma grew in popularity and took over a portion of the market share previously held by RedLine. Redline infected 9.9 million hosts, or 43% of all infostealer infections observed by Flashpoint in 2024. The next four most-prolific infostealers in 2024, including RisePro, SteaC, Lumma Stealer, and Meta Stealer, infected a <a href="https://cyberscoop.com/infostealers-cybercrime-surged-2024-flashpoint/">combined 7 million hosts</a>. 
We expect to see something similar following the Lumma Stealer takedown operation. The disruption effect following takedown is real, but there are still some new infections and logs for sale that were likely stolen before the infrastructure was taken down. Additionally, just because Lumma&rsquo;s infrastructure was dismantled, a lot of the data it stole likely continues to live on the dark web&mdash;thanks to the cybercriminal ecosystem that resells this information. Additionally, <a href="https://blog.checkpoint.com/security/lumma-infostealer-down-but-not-out/">CheckPoint</a> reported Lumma&rsquo;s developers are already trying to rebuild and restart their operations, which may or may not be successful.&nbsp;As SpyCloud&rsquo;s <a href="https://www.linkedin.com/posts/thilligoss_lummatakedown-lummareallynowork-stealc-activity-7332888157480198146-u94p">Trevor Hilligoss shared</a>, daily new Lumma infections have trended downward following the takedown but not as much as expected. Continued monitoring will be necessary to determine the takedown&rsquo;s impact. 
Long-standing groups such as Vidar and Stealc are good examples of this, but other newer families, such as Acreed, will also be well positioned to increase their market share. <a href="https://www.bleepingcomputer.com/news/security/russian-market-emerges-as-a-go-to-shop-for-stolen-credentials/">ReliaQuests</a> already reported Acreed is rapidly gaining traction following the Lumma takedown. <a href="https://webz.io/dwp/acreed-infostealer-everything-we-know-so-far/">Over 4,000 logs</a> stolen by Acreed were reportedly uploaded to the Russian Market within its first week of operations.&nbsp;Nexus has also gained some traction over the last week in Lumma&rsquo;s absence. Further, former affiliates and/or administrators associated with Lumma itself may split off to create their own offerings.

<img src="https://cdn.lputil.com/-/media/ffef2d4ef9d544babc2169a6d0274059.jpg?h=310&amp;w=624" >&nbsp;
Daily new LummaC2 infections (Source: Trevor Hilligoss)
<h2>How to protect yourself against infostealers</h2>
The threat from infostealers will remain very real for the foreseeable future and continue to adapt. Oftentimes, stealers are used in indiscriminate campaigns. Additionally, the sheer volume of data that has been dumped on the internet is immense. That means anyone is fair game and should take action to protect themselves following that assumption that they could be targeted. 
<ul>
 <li>Use strong, unique passwords for every account. This will prevent credential stuffing attacks, which is a common tactic where threat actors insert stolen usernames and passwords. That way, if one password is exposed, it won&rsquo;t give access to all your other accounts where you reuse the same password. Also, consider using a password manager to securely and conveniently store them.</li>
 <li>Enable MFA on your accounts. While this measure isn&rsquo;t failproof on its own, it adds an additional layer of defense and makes you a harder target.</li>
 <li>Be on guard for phishing attempts. Infostealers often spread through phishing emails and malicious downloads. </li>
 <li>Check HaveIBeenPwned to monitor potential exposure if you&rsquo;re worried you may have been infected by an infostealer. </li>
</ul>

What the Lumma stealer takedown means for the infostealer market and your personal data

Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkey vs Password: Which is More Secure? | LastPass

Explore the differences between passkeys and passwords. Learn how LastPass enhances security and simplifies access with advanced authentication methods.

Blog

Blog

Recent

News & Insights

Cybersecurity

Product Tutorials

Threat Intel

Product Updates

Tips And Tricks