You might have seen <a href="https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024">this shocking prediction from Gartner:</a> by 2027, 75% of employees will acquire, modify or create technology outside IT&rsquo;s visibility &ndash; up from 41% in 2022.&nbsp;
Your employees rely on more SaaS tools than ever and not all of them are on your radar. &nbsp; 
From cloud apps and browser extensions to AI tools, today&rsquo;s workplaces move fast. And when anyone can implement a new app with little more than a credit card and a dream, you can be sure that very few of them are thinking about access or credential management. Consider this:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Shadow IT and Shadow AI are expanding the attack surface, with unsanctioned tools introducing security gaps no one&rsquo;s monitoring.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">App bloat is costing real money &mdash; small businesses now pay for an average of 134 unused applications, and large organizations pay for 473.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Sensitive data is slipping through the cracks, with 38% of employees admitting they&rsquo;ve shared work information with unauthorized AI tools.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Compliance is harder to maintain when there&rsquo;s no clear picture of who&rsquo;s accessing what, and from where.&nbsp;</li>
</ul>
Single sign-on (SSO) can help with your core apps-- the ones that you know about-- but it doesn&rsquo;t cover everything, especially those smaller, hidden apps. And for small and mid-sized businesses, controlling those can get expensive and time-consuming, fast.&nbsp;&nbsp;
That&rsquo;s where the security gaps start. Without a simple, customizable way to manage access, secure credentials and monitor app usage, it&rsquo;s easy to lose control. And that opens the door to risk from old accounts that still have access to sensitive info, to apps no one remembers signing up for.&nbsp;
It&rsquo;s no longer enough to secure passwords alone. Businesses need an approach to identity and access management that&rsquo;s as flexible, efficient, and user-friendly as the tools their employees actually use.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">What is Secure Access Experiences?&nbsp;&nbsp;</h2>
Secure Access Experiences is the LastPass answer to this growing access management crisis &mdash; an evolving approach designed to bring together essential capabilities into one intuitive experience. It helps you control who has access to what, based on your own policies &mdash; not just passwords. Whether your team is using approved tools or ones you didn&rsquo;t even know about, you&rsquo;ll get the visibility and control you need, all in one easy-to-use solution.&nbsp;
With Secure Access Experiences, you will be able to:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Log in with ease: Securely manage how your team stores and uses passwords. Support for passkeys makes logging in even faster and safer.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Control who gets access: Make sure the right people have access to the right apps, systems, and data&mdash;nothing more, nothing less. It&rsquo;s easy to set up and adjust as your business grows.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">See what&rsquo;s happening: Know which apps your team is using, when, and how. Stay informed, spot issues early, and feel confident that everything&rsquo;s running smoothly.&nbsp;&nbsp;&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Why do Secure Access Experiences matter?&nbsp;</h2>
As SaaS adoption grows and the lines between personal and professional tools blur, businesses need a smarter, simpler way to manage access &mdash; one that meets modern challenges head-on, without overwhelming teams or breaking the bank.&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Grows with your business: As your business adds more tools, people, and locations, LastPass makes it easy to keep everything secure without slowing you down.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Easy to manage, easier on your budget: Control access to all your tools from one place. Less hassle for you, and no need to invest in multiple systems.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Provides better protection, fewer headaches: Keep your business safe with strong, simple security&mdash;and make it easier to meet industry requirements along the way.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Simple for your team to use: When it&rsquo;s easy to use, your team actually uses it. That means stronger habits, less risk, and happier employees.&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">It starts with SaaS Monitoring and SaaS Protect.&nbsp;</h2>
You can&rsquo;t control what you can&rsquo;t see. The first capability in Secure Access Experiences was&nbsp;SaaS Monitoring. Now, SaaS Protect is available so that customers can take action on that visibility.&nbsp;&nbsp;&nbsp;
<img src="https://cdn.lputil.com/-/media/2b6fd9bba92346a8a0fcedeca39eed06.png?h=824&amp;w=1250" >
<p class="Paragraph SCXW34306727 BCX0" paraid="543943140" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{232}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">With SaaS Monitoring and SaaS Protect, business owners and IT admins can finally see what apps are being used across their organization, spot risky behavior, and make informed decisions about which apps to allow, restrict, or retire. helping them detect unapproved tools, spot Shadow IT and Shadow AI, and optimize application investments &mdash; all without the need to deploy extra agents, integrations, or complexity.
<p class="Paragraph SCXW34306727 BCX0" paraid="713470910" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{238}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">The future of easier visibility and control is here. Start your Secure Access Experiences journey today.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>

Introducing Secure Access Experiences: Controlling the Chaos of Modern App Sprawl

Secure Access Experiences is the LastPass answer to this growing access management crisis.

Get LastPass Free

Create and store secure passwords for yourself, your team or business.

Why LastPass?

Remember fewer passwords and log in faster with our browser extension.

How LastPass works

LastPass zero-knowledge security model keeps your data private even from us.

Security Architecture

Compare LastPass competitors, plans, and features in one place

Compare LastPass

Overview

Password management

Save and autofill

Password generator

Password sharing

Passkeys

Dark web monitoring

Security dashboard

SaaS Monitoring

Key Features

Free LastPass Premium trial, no credit card required.

Free LastPass Business trial, no credit card required.

Let our experts help you find the right plan and successfully deploy LastPass.

Sync passwords across all devices, monitor password health, data breaches and much more.

Personal

Premium password management for family or group of 6 people.

Families

Personal Plans

30-day free LastPass Premium trial, no credit card required.

30-day free LastPass Families trial, no credit card required.

Limited to 1 device type and basic password management features.

Designed for businesses of all sizes, from small startups to enterprises.

Business

Gain complete visibility into your organization’s entire SaaS footprint.

Business Max

For single teams just getting started with password management.

Teams

Designed to keep your clients' credentials protected and private.

Business Plans

User management

SaaS Protect

Business sharing

Multifactor Authentication

Integrations

Single Sign-on

Identity management

For admins

Marketing teams

Legal teams

HR teams

Business leaders

IT admins

Solutions by role

Case studies

Webinars

Product demos

Events

Trust Center

Compliance Center

Security architecture

LastPass University

Resource Center

Pricing

Join the LastPass Partner Program to provide even more value to your customers.

Partner program overview

Managed Service Providers

Resellers

Cloud marketplaces

Technology Alliance Partners

LastPass Partner Program

Grow new revenue streams by meeting customer's security needs.

Looking for help or interested in becoming a LastPass partner? Get in touch with our partner team.

Connect with trusted LastPass Partners to support your security needs.

Partners

Self-service library of resources and guides for all LastPass products.

Support Center

Community forum

System status

Help

Personal support for all LastPass’ subscribed customers.

Support

Get LastPass free

Submit sales inquiry

Call sales

Request a demo

Find a partner

Contact sales

Log in

How to reset your Discovery Plus password

To unlock access to the content you love, use our easy Discovery Plus password reset instructions. 

How to Reset Your Discovery Plus Password

Businesses are relying more and more on a growing SaaS ecosystem to drive productivity, collaboration, and innovation. And why not? SaaS is cost effective, scalable, and easy to use.&nbsp;&nbsp;
But with growth comes risk in the form of unchecked app sprawl. This&nbsp;<a href="https://blog.lastpass.com/posts/saas-sprawl">SaaS sprawl</a>&nbsp;can result in unapproved tech being used at your business (Shadow IT), which can lead to data breaches, data loss, credential compromises, compliance violations, and potentially millions of dollars in lost revenue.&nbsp;
While tools like&nbsp;<a href="https://blog.lastpass.com/posts/clarity-not-chaos-take-back-control-with-lastpass-saas-monitoring">LastPass SaaS Monitoring</a>&nbsp;offer critical visibility into app usage, visibility alone isn&rsquo;t enough. Your business needs the power to act &ndash; to stop SaaS risk and credential misuse in its tracks.&nbsp;&nbsp;
Enter&nbsp;LastPass SaaS Protect.&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Introducing LastPass SaaS Protect&nbsp;</h2>
SaaS Protect builds upon LastPass SaaS Monitoring capabilities to&nbsp;transform visibility into action:&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li4" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Block high-risk apps. &nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li4" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Alert users to weak credentials in real-time.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li4" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Establish and enforce usage policies. &nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li5" style="color: rgba(0, 0, 0, 0.85); background-color: #ffffff; margin: 0px;">Guide user behavior through customizable warning messages.&nbsp;&nbsp;</li>
</ul>
All within a single dashboard. No agents. No third-party tools.&nbsp;
<h3 class="p7" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">See Risk. Stop Risk.&nbsp;</h3>
SaaS Protect helps safeguard the business applications that power your organization. Insights become actionable. Your security becomes stronger.&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li4" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Enforce app policies instantly:&nbsp;Classify applications as Approved, Warn, or Blocked to restrict unapproved or risky tools. &nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li4" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Address credential weakness:&nbsp;Detect reused or weak passwords and guide users toward stronger password hygiene.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li5" style="color: rgba(0, 0, 0, 0.85); background-color: #ffffff; margin: 0px;">Track every enforcement:&nbsp;View audit logs and usage reports that provide full visibility into app usage, policy actions, and security posture, which can map to common compliance frameworks.&nbsp;&nbsp;</li>
</ul>
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">What LastPass SaaS Protect Can Do for You&nbsp;</h2>
SaaS Protect isn&rsquo;t just a security tool. It&rsquo;s an integral part of your larger security strategy, helping you to secure the tools your business depends on the most.&nbsp;
<h3 class="li4" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Govern SaaS usage with enforced app policies&nbsp;</h3>
Define and enforce policies that determine which apps are allowed, restricted, or blocked to prevent access to unsanctioned or high-risk SaaS and generative AI tools before they become a threat. Safe usage can also be guided through custom messaging.&nbsp;
<h3 class="li4" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Prevent account takeover from credential misuse&nbsp;</h3>
Weak credentials &ndash; the leading cause of data breaches &ndash; are often overlooked. SaaS Protect detects weak or reused passwords in real time and alerts security teams before compromised credentials can be exploited by attackers.&nbsp;
<h3 class="li4" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Demonstrate compliance with audit-ready reporting&nbsp;</h3>
Generate detailed governance reports that align with frameworks like SOC 2, HIPAA, and GDPR. These reports help prove compliance to auditors and customers, reinforcing trust and accountability.&nbsp;
<h3 class="li4" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Optimize SaaS spend by eliminating redundancy&nbsp;</h3>
Duplicate, unused, or abandoned apps contribute to tech sprawl and wasted spend. SaaS Protect helps you identify and remove these inefficiencies, streamlining your SaaS environment and cutting unnecessary costs.&nbsp;
<h2 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Smart SaaS Security Starts with LastPass SaaS Protect&nbsp;</h2>
<h3 class="p8" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 16px;">The challenge: Cracking down on rogue apps and weak credentials can create friction.&nbsp;&nbsp;</h3>
SaaS Protect helps you take control of app access without slowing down your teams.&nbsp;With clear usage visibility and one-click policies, business leaders can make informed decisions about which tools to support, retire, or restrict all without interrupting workflows.&nbsp;They can also guide users to approved and sanctioned apps, allowing them to do their jobs efficiently and securely.&nbsp;
<h3 class="p7" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">The challenge: Traditional SaaS security tools are too expensive, complex, and slow to implement.&nbsp;</h3>
For IT teams, SaaS Protect delivers control over app access, credential hygiene, and user behavior &ndash; all from a lightweight intuitive dashboard. Just clear, actionable protection that helps you reduce risk, support compliance, and stay ahead of threats. It&rsquo;s security that works with your workforce, not against it.&nbsp;
SaaS Monitoring and SaaS Protect offer a smarter, simpler alternative to SaaS risk. Together, they give you full visibility and control over your SaaS environment &ndash; all from a single LastPass dashboard.&nbsp;
Move fast, stay secure, and do more with less.&nbsp;<a rel="noopener noreferrer" href="https://www.lastpass.com/trial/business?max=true" target="_blank">Try LastPass SaaS Protect today</a>.&nbsp;&nbsp;

Visibility Now Meets Control: Take Charge of SaaS Risk with LastPass SaaS Protect

SaaS Protect builds upon LastPass SaaS Monitoring capabilities to transform visibility into action.

This blog post is the product of joint research conducted with our friends at GuidePoint Security and their GRIT Threat Intelligence team. We deeply appreciate their partnership and are proud to present this shared analysis for the benefit of the larger community. You can view the <a href="https://www.guidepointsecurity.com/blog/the-rise-of-infostealers-identity-theft-fuels-cybercrime-economy/">full report</a> on the GuidePoint Security website.&nbsp;
The LastPass Threat Intelligence, Mitigation, and Escalations (TIME) team recently joined forces with GuidePoint Security&rsquo;s GRIT Threat Intelligence team to highlight the threats posed by infostealers. This report provides a deep dive into explaining how infostealers work, from their functionality to their sales on the underground market. Infostealers have been a major contributing factor driving cybercrime activity since credentials are the primary keys to accessing digital systems and data. The recent exposure of <a href="https://blog.lastpass.com/posts/16-billion-credential-leak">16 billion login credentials</a> isn&rsquo;t just a staggering number&mdash;it&rsquo;s a wakeup call. At the heart of this breach is the underlying real threat: infostealers. 
What infostealers are after is straightforward: collecting credentials and other sensitive information. Stealers now go beyond stealing usernames and passwords. They also compromise browser cookies, session cookies, and more. This can enable follow-on attacks, like targeted social engineering, bypassing multi-factor authentication (MFA), and account takeover. Once threat actors steal this information, they package it up into logs and sell them on the dark web. Stealers have evolved and become more sophisticated. Many stealers are now capable of getting around devices with anti-virus software and/or endpoint detection and response solutions. Server-side stealers are another advancement, shifting from previous client-side methods (where the malware is downloaded and executed entirely on a victim&rsquo;s machine) to a lighter, quieter execution where a few lines of code can set up a TOR server to exfiltrate data from an infected machine. 
The report also explores how stealers operate under the Malware-as-a-Service (model) where malware developers run the operations to support customers who buy the license to use the malware. It&rsquo;s basically a professionalized service that facilitates widespread attacks by lowering the barrier to entry for less sophisticated actors. &ldquo;Essentially, today&rsquo;s MaaS infostealer model and its supporting websites have transformed many threat actors into small business owners, settling into a cycle of licensing, compromising victims, and selling harvested information to generate a return on their investment.&rdquo; As our report points out, &ldquo;the nature of the Malware-as-a-Service (MaaS) model means there are no restrictions on how an actor may choose to infect their victims. Threat actors are constantly evolving their tactics and innovating new ways to trick their victims into clicking links, engaging in adversary social engineering foolery, or blindly following instructions.&rdquo; These techniques will continue to evolve to compromise machines. 
Despite its severity, the infostealer threat isn&rsquo;t all doom and gloom. Our report outlines several steps you can take to protect you and your organization from being the victim of an infostealer infection. For example, defenders can integrate threat feed-provided indicators to identify or prevent connection attempts to known Command-and-Control (C2) infrastructure. Monitoring the dark web for exposed credentials is another good preventative measure. Password managers can also avoid password reuse, which enables brute-force attacks, or storing unencrypted credentials on browsers, which are a major target after stealers infect a system because threat actors know this is a common poor cybersecurity practice. 
 Between the proliferation of stealers and their growing sophistication, this threat will remain one of the key challenges to securing identity for the foreseeable future. That&rsquo;s why we highlighted stealers as <a href="https://blog.lastpass.com/posts/2025-cybersecurity-trends">one of the top cyber threat predictions</a> for 2025. We talk about recent cyberattacks that are enabled by infostealers and emphasize the severity of this threat, like the Change Healthcare breach in 2024 and Hellcat targeting Schneider Electric, Telef&oacute;nica, Orange Group, and more. The <a href="https://lastpass-1.wistia.com/medias/oj3fopvhzj">TIME team recently shared insights</a> into infostealer trends and several other key trends shaping the cyber threat environment as a mid-year check in if you want to learn more. &nbsp;&nbsp;

Joint Report with LastPass and GuidePoint Security Researchers: Fighting Back Against Infostealers

The LastPass Threat Intelligence, Mitigation, and Escalations (TIME) team recently joined forces with GuidePoint Security’s GRIT Threat Intelligence team to highlight the threats posed by infostealers. This report provides a deep dive into explaining how infostealers work, from their functionality to their sales on the underground market. Infostealers have been a major contributing factor driving cybercrime activity since credentials are the primary keys to accessing digital systems and data. The recent exposure of 16 billion login credentials isn’t just a staggering number—it’s a wakeup call. At the heart of this breach is the underlying real threat: infostealers. 

Joint Report with LastPass and GuidePoint Security Researchers: “Fighting Back Against Infostealers and How to Build Resilience in a Digital Identity Crisis”  

Types of credit card fraud

We explore 7 types of credit card fraud you can't ignore

Exposed: 7 Types of Credit Card Fraud You Can’t Afford to Ignore 

The LastPass TIME Team is thrilled to share the second episode of our new podcast, The Phish Bowl! Join us every month as my co-host, friend, and colleague Mike Kosak and I (Stephanie Schneider) dive into the global cyber threat landscape. Every episode, we&rsquo;ll unpack what&rsquo;s really going on beneath the surface, exploring the globe region by region. For our second episode, we kicked things off with a deep dive into the cyber threat environment in Europe. We&rsquo;re also publishing a <a href="https://info.lastpass.com/threat-reports">new report</a> for each region on a quarterly basis that will serve as the foundation for the podcast.&nbsp;&nbsp;
<iframe width="560" height="315" src="https://www.youtube.com/embed/gv5iip8dKAs?si=qBO6gk41KVM7P8t5" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe>
Europe has continued to experience a moderate threat level compared to other regions. Europe&rsquo;s strong economies, high internet penetration rate, involvement in the ongoing Russia-Ukraine and Israel-Gaza conflicts, and digital ecosystem vulnerabilities make it a particularly attractive target for hackers. Special guest Daniel Card, Cybersecurity Consultant at PwnDefend, joined to share lessons learned from the field, plus thoughts on the UK&rsquo;s Online Safety Act and how orgs can better defend against threats.
<h2>What&rsquo;s driving the heightened cyber threat environment in Europe?</h2>
 
To frame the second episode&rsquo;s discussion on cyber threats in Europe, let&rsquo;s start by highlighting some regional trends and activity to put things in perspective. We just published a <a href="https://info.lastpass.com/threat-reports">regional report</a> on Europe that does an even deeper dive if you want to read more. 
IBM&rsquo;s <a href="https://www.ibm.com/thought-leadership/institute-business-value/report/2025-threat-intelligence-index">X-Force 2025 Threat Intelligence Index</a> found Europe was the third most targeted region after Asia-Pacific and North America last year. Attacks are continuing at a high frequency this year driven by several factors, including active conflicts in Ukraine and Gaza which have the potential to spill over into supporting countries, and the rise of cybercrime, such as the recent Scattered Spider campaigns targeting the UK retail sector (more on that in a bit). In Q2 2025, attacks against Europe jumped , marking the highest year-over-year (YoY) growth in regional attack volume (22%). The United Kingdom was the most targeted country in Europe, followed by Germany (18%) and Austria (14%), which are among the top economies in the region. 
Ransomware is one of the most prevalent types of attacks targeting the region. Europe accounted for 25% of reported ransomware incidents, coming in second place after North America at 53% in Q2 2025. Germany and the UK are among second tier ransomware targets compared to the US (52%). Several other European countries are also significantly targeted by ransomware to a lesser extent. Speaking of ransomware and cybercrime&hellip; 
<h2>Scattered Spider weaves its web to trap UK retailers</h2>
Scattered Spider has been splashed across news headlines of late. The group is infamous, responsible for significant breaches over the last few years, like Okta and MGM Resorts. They&rsquo;re interwoven with other notorious groups like The Com and LAPSUS$. Social engineering is the name of their game. Scattered Spider frequently leverages IT help desks to gain unauthorized access, targeting both IT help desk employees and organizations&rsquo; employees. Since first emerging in 2022, the group has been linked to over 100 attacks across multiple market verticals but tends to target one sector at a time. As one of their latest victims, Scattered Spider targeted the UK retail sector in April, before pivoting their industry focus to US insurance, airlines and transportation, and finance. 
As part of their evolution, they&rsquo;ve moved from conducting primarily US-focused attacks to more global in nature, such as the recent campaigns in UK and Australia. They&rsquo;ve also progressed their TTPs from phishing kits and SIM swapping to broader approaches, among other advancements. As Mike points out, they&rsquo;ve become more technically savvy, shifting from exfiltration to deploying ransomware, and have gotten better at reconnaissance, often going after credentials stored in clear text. 
Our discussion highlighted several lessons learned from the recent Scattered Spider attacks: 
<ol>
 <li>The power of simple social engineering. Attackers frequently get around security systems with phishing calls to trick help-desk staff into resetting passwords, exploiting weak or reused credentials without MFA, and using local IP proxies or other means to appear legitimate.</li>
 <li>Embracing threat fluidity. Traditional threat modeling treats hackers as separate teams, but individuals can join and leave operations at will, share intel, swap roles, and more. Cool names like Dragonforce or Shiny Hunters make splashy headlines, but defenders should recognize these groups aren&rsquo;t operating in separate silos. </li>
 <li>Building real resilience. We can take straightforward steps to transform from easy targets into hardened, resilient environments to stop attacks before they even begin. To push back, start with enforcing strong, unique passwords and mandating MFA; automating patching on all critical, internet-facing systems; and continuously monitoring for exposed credentials.</li>
</ol>
<h2>Joint advisory recommendations</h2>
 
In response to these widespread, damaging attacks, several governments issued a joint alert and warnings about Scattered Spider&rsquo;s updated TTPs to raise awareness and stay ahead of this threat. We strongly encourage folks to review these advisories for additional <a href="https://www.cisa.gov/news-events/alerts/2025/07/29/cisa-and-partners-release-updated-advisory-scattered-spider-group">recommendations</a>. Here are a few steps you can take to protect yourself and your organization against Scattered Spider-style social engineering attacks:
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Train help desk staff and employees to recognize and shut down social engineering tactics. Social engineering goes after the weakest link in cybersecurity: humans.&nbsp;&nbsp;&nbsp;</li>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Strong identity access controls, including:&nbsp;&nbsp;
 <ul class="ul2">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Least privileged access&nbsp;</li>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Segmentation to prevent lateral movement&nbsp;</li>
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Phishing-resistant MFA and passkeys, across all user accounts, and especially for administrative accounts with privileged access&nbsp;</li>
 </ul>
 </li>
 <li class="li2" style="color: rgba(0, 0, 0, 0.85); background-color: #ffffff; margin: 0px;">Stick to approved channels for communications to prevent MFA bombing/fatigue, a tactic Scattered Spider has commonly used to bypass defenses.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
</ul>
<h2>Mastering the fundamentals to minimize cyber risk</h2>
Daniel&rsquo;s real-world anecdotes and no-nonsense advice underscore a crucial message: simplicity in security controls can yield outsized protection. Leaving front doors open, even unintentionally, invites compromise. The vast majority of breaches stem from credential theft and human error (phishing, weak or reused passwords, lack of MFA), not always from advanced zero-day exploits. By mastering the fundamentals&mdash;enforcing unique strong passwords, rolling out MFA, keeping systems patched, and continuously scanning for exposed credentials&mdash;organizations can block most attacks and respond swiftly when incidents inevitably occur. 
<h2>Insights on the UK&rsquo;s Online Safety Act</h2>
The UK&rsquo;s Online Safety Act aims to protect children online, but as Daniel highlighted, narrowing the focus to a single group without considering workarounds and systemic failures, can lead to blind spots. Real-world testing revealed uneven implementation of this well-intentioned policy. While child safety is vital, effective regulation needs to consider all users and the full breadth of internet services&mdash;search engines, apps, and browsers alike&mdash;to prevent harm without creating loopholes or enforcement gaps.
<h2>Listen to the full episode&nbsp;&nbsp;</h2>
We&rsquo;ve got the wheels rolling on this podcast now. Thanks for sticking around if you&rsquo;re coming back for more, and if you&rsquo;re new here, welcome!
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Listen to Episode 2 of&nbsp;The Phish Bowl&nbsp;wherever you get your podcasts: &nbsp;
 <ul>
 <li class="li2" style="color: #386573; margin: 0px;"><a href="https://www.youtube.com/@LastPass/podcasts">YouTube</a>&nbsp;&nbsp;</li>
 <li class="li2" style="color: #386573; margin: 0px;"><a href="https://open.spotify.com/show/1TQiFDk9acmkfp1sTFN1yX">Spotify</a>&nbsp;&nbsp;</li>
 <li class="li3" style="color: #386573; background-color: #ffffff; margin: 0px;"><a href="https://podcasts.apple.com/podcast/id1828511920">Apple</a>&nbsp;&nbsp;</li>
 </ul>
 </li>
</ul>
<ul>
 <li>Subscribe for monthly threat intel deep dives. </li>
 <li>Access LastPass's <a href="https://info.lastpass.com/threat-reports">Regional Report</a> for detailed analysis of recent Europe trends and activity. </li>
 <li>Check out the <a rel="noopener noreferrer" href="https://blog.lastpass.com/categories/lastpass-labs" target="_blank">LastPass Labs blog</a> for more insights.&nbsp;</li>
</ul>
See you next month to talk about more threat environment updates in North America, along with a corresponding regional report!

Cybercrime in Europe: What We Covered in the Second Episode of The Phish Bowl

The LastPass TIME Team is thrilled to share the second episode of our new podcast, The Phish Bowl! 

remote code execution attack

Your practical guide to understanding and defending against remote code execution (RCE). 

Your Practical Guide to Understanding and Defending Against Remote Code Execution (RCE) 

account.live.com password reset

Microsoft password reset made easy: What to do when you get locked out of your account  

Microsoft Password Reset Made Easy: What to Do When You Get Locked Out of Your Account  

Preventing Clickjacking Attacks | LastPass

Discover what clickjacking is, its impact on online security, and how LastPass helps protect users from this type of malicious attack. Learn more now. 

What Is Clickjacking and How to Prevent It

What is a rootkit?

We explain what rootkits are and why you should care. 

Rootkits Uncovered: What They Are and Why You Should Care 

Say goodbye to forgotten credentials and phishing attempts. Say hello to fast, secure, and frictionless authentication across all your devices.&nbsp;&nbsp;
You can now create, store, and manage passkeys with LastPass, making sign-ins faster, easier, and safer across your favorite apps and websites. Your passkeys live in your LastPass vault, right alongside your passwords &ndash; always private and within reach.&nbsp;&nbsp;
If you&rsquo;ve ever wanted a login experience that doesn&rsquo;t involve typing (or forgetting) a password, passkeys are for you.&nbsp;&nbsp;
<div class="button-container"><a href="https://www.lastpass.com/trial/business"><button class="lp-button lp-button--primary">Try Business</button></a><a href="https://lastpass.com/create-account.php?premium=1"><button class="class lp-button--red-outline">Try Personal</button></a></div>
<h2 class="p2" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">What&rsquo;s a passkey, anyway?&nbsp;</h2>
Passkeys are <a href="https://blog.lastpass.com/posts/passkey-vs-password">a public and private key pair,</a> unique to each site they&rsquo;re created for. The public key is stored by the app or website while the private key is stored on your device.&nbsp;&nbsp;
When you want to login, your device uses the private key to prove your identity. Instead of typing something in, you&rsquo;ll use your fingerprint, face or device PIN to sign in.&nbsp;&nbsp;
The best part about passkeys? They&rsquo;re unique to each site and can&rsquo;t be guessed, stolen, or reused, making them inherently <a href="https://blog.lastpass.com/posts/are-passkeys-really-phishing-resistant">resistant to phishing</a>, credential stuffing, shoulder surfing, and other remote attacks.&nbsp;&nbsp;
<h3 class="p3" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">All your logins in one place&nbsp;</h3>
Whether password or passkey, LastPass keeps everything stored in one secure vault. It doesn&rsquo;t matter where your passkey originated from or what device you need to use it on &ndash; LastPass provides full and frictionless access, right alongside your passwords and other important items.&nbsp;&nbsp;
And since your private key stays securely in LastPass, you&rsquo;re protected even if the site you&rsquo;re logging into is compromised.&nbsp;&nbsp;
Plus, LastPass is platform-agnostic. That means your passkeys work across browsers, operating systems, and devices no matter where you created them.&nbsp;&nbsp;
<div class="button-container"><a href="https://www.lastpass.com/trial/business"><button class="lp-button lp-button--primary">Try Business</button></a><a href="https://lastpass.com/create-account.php?premium=1"><button class="class lp-button--red-outline">Try Personal</button></a></div>
<h3 class="p2" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Less friction, more security&nbsp;</h3>
Businesses can enable passkey support via LastPass Admin policy, giving employees a secure, seamless login experience that reduces credential reuse and forgotten passwords.&nbsp;
Passkeys are never stored on your organization&rsquo;s server &ndash; public keys are tied to the website or app and private keys are secure with LastPass &ndash; which translates to a reduction in server-based attacks.&nbsp;&nbsp;
And their frictionless nature means faster rollout across your organization. With seamless passkey support in LastPass, teams can adopt secure login methods quickly and at scale.&nbsp;&nbsp;
But don&rsquo;t just take our word for it: 90% of IT leaders believe that passkeys will have a <a href="https://www.lastpass.com//-/media/f13bb123867048bd92ddb95bb58f9407.pdf">significant impact</a> on their businesses while 92% say passkeys will benefit their overall <a href="https://www.lastpass.com//-/media/2a928b6acd804afa9e699bb4c262cc14.pdf">security posture</a>.&nbsp;&nbsp;
<h2 class="p2" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Getting started is easy&nbsp;</h2>
<iframe width="560" height="315" src="https://www.youtube.com/embed/kl0mt9ZWYf8?si=2oz015Il1AQrBPdY" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe>
Ready to give passkeys a try? Here&rsquo;s how to get started:&nbsp;
<ol>
 <li class="li5" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Update your LastPass browser extension or mobile app to the latest version.&nbsp;&nbsp; 
 
 </li>
 <li class="li5" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Visit a site or app that supports passkeys (check out <a href="https://fidoalliance.org/passkeys-directory/">the FIDO Passkey Directory</a> for a growing list).&nbsp;&nbsp; 
 
 </li>
 <li class="li5" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Create a passkey when prompted and save it to your LastPass vault (yes, your LastPass master password is still required to access your vault).&nbsp;</li>
</ol>
And you&rsquo;re done! Use your passkey to log in next time with just a tap or biometric scan.&nbsp;&nbsp;&nbsp;
The future of logins is here. Whether you&rsquo;re an individual looking for a simpler way to sign in or a business ready to strength your security posture, passkeys offer a better, safer experience.&nbsp;&nbsp;
So go ahead: update your app, explore compatible sites, and start creating passkeys with LastPass
<div class="button-container"><a href="https://www.lastpass.com/trial/business"><button class="lp-button lp-button--primary">Try Business</button></a><a href="https://lastpass.com/create-account.php?premium=1"><button class="class lp-button--red-outline">Try Personal</button></a></div>

LastPass Now Supports Passkeys

Whether you’re an individual looking for a simpler way to sign in or a business ready to strength your security posture, passkeys offer a better, safer experience.  

Faster, Safer, and Seamless Logins Are Here: LastPass Now Supports Passkeys

How to reset your Lenovo laptop password

We’re going to provide answers for resetting the four types of Lenovo owner passwords. 

From Locked Out to Fresh Start: How to Reset Your Lenovo Laptop Password with Confidence 

One chapter in the saga of infostealer malware has ended&mdash;at least for now&mdash;after a global law enforcement takedown of Lumma Stealer in mid-May. US, European, and Japanese authorities, with the help of tech companies including Microsoft and Cloudflare, took down, suspended, and blocked approximately 2,300 malicious domains that made up part of the infostealer&rsquo;s backbone. The FBI also seized domains that served as login panels allowing other criminals to access and use the infostealer. Although, this seizure is intended to effectively prevent criminals from being able to access Lumma to compromise computers and steal data, the overall stealer threat will remain prevalent for the foreseeable future. 
(Interested in learning more about the infostealer threat outlook? Read the LastPass TIME team&rsquo;s threat predictions and analysis on <a href="https://blog.lastpass.com/posts/2025-cybersecurity-trends">what direction infostealers and other threats are heading</a>.) 
<h2>What is Lumma?</h2>
 
Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022. Since its initial release, Lumma&rsquo;s developers have released multiple upgraded versions of the software. Before the malware-as-a-service (MaaS) platform was dismantled, the FBI linked Lumma to around <a href="https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted">10 million infections</a> globally. Lumma&rsquo;s follow-on attacks involving stealing credentials, cryptocurrency data, and credit card information have resulted in an estimated <a href="https://cyberscoop.com/lumma-infostealer-widespread-victims/">$36.5 million USD</a> in credit card theft in 2023. The malware hit individuals and a wide range of industries, including Fortune 500 companies, airlines, universities, banks, and hospitals. 
What makes this stealer particularly effective is that it continues to evolve to bypass security layers even as defenders are responding to the threat. On top of grabbing browser-stored passwords and cookies, it&rsquo;s also capable of extracting autofill data, email credentials, File Transfer Protocol (FTP) data, and two-factor authentication tokens and backup codes. Using its MaaS platform, its creators sold access to the malware on multiple underground markets and platforms like Telegram. 
<h2>What comes next?</h2>
 
This takedown is a major win for law enforcement and will help disrupt the initial access broker ecosystem in the near term. However, this is an ecosystem that has demonstrated its resilience again and again. The number of existing infostealer families, the open access to numerous source codes of previous infostealers, and the constant demand create a lucrative environment with very low barriers to entry. Given the resiliency of this market, other infostealer will likely quickly step in and fill in the gaps left after the Lumma takedown. 
A similar pattern previously played out with other similar takedowns. On October 28, 2024, Operation Magnus disrupted the RedLine and META infostealers. RedLine was a significant stealer last year up until the takedown, after which Lumma grew in popularity and took over a portion of the market share previously held by RedLine. Redline infected 9.9 million hosts, or 43% of all infostealer infections observed by Flashpoint in 2024. The next four most-prolific infostealers in 2024, including RisePro, SteaC, Lumma Stealer, and Meta Stealer, infected a <a href="https://cyberscoop.com/infostealers-cybercrime-surged-2024-flashpoint/">combined 7 million hosts</a>. 
We expect to see something similar following the Lumma Stealer takedown operation. The disruption effect following takedown is real, but there are still some new infections and logs for sale that were likely stolen before the infrastructure was taken down. Additionally, just because Lumma&rsquo;s infrastructure was dismantled, a lot of the data it stole likely continues to live on the dark web&mdash;thanks to the cybercriminal ecosystem that resells this information. Additionally, <a href="https://blog.checkpoint.com/security/lumma-infostealer-down-but-not-out/">CheckPoint</a> reported Lumma&rsquo;s developers are already trying to rebuild and restart their operations, which may or may not be successful.&nbsp;As SpyCloud&rsquo;s <a href="https://www.linkedin.com/posts/thilligoss_lummatakedown-lummareallynowork-stealc-activity-7332888157480198146-u94p">Trevor Hilligoss shared</a>, daily new Lumma infections have trended downward following the takedown but not as much as expected. Continued monitoring will be necessary to determine the takedown&rsquo;s impact. 
Long-standing groups such as Vidar and Stealc are good examples of this, but other newer families, such as Acreed, will also be well positioned to increase their market share. <a href="https://www.bleepingcomputer.com/news/security/russian-market-emerges-as-a-go-to-shop-for-stolen-credentials/">ReliaQuests</a> already reported Acreed is rapidly gaining traction following the Lumma takedown. <a href="https://webz.io/dwp/acreed-infostealer-everything-we-know-so-far/">Over 4,000 logs</a> stolen by Acreed were reportedly uploaded to the Russian Market within its first week of operations.&nbsp;Nexus has also gained some traction over the last week in Lumma&rsquo;s absence. Further, former affiliates and/or administrators associated with Lumma itself may split off to create their own offerings.

<img src="https://cdn.lputil.com/-/media/ffef2d4ef9d544babc2169a6d0274059.jpg?h=310&amp;w=624" >&nbsp;
Daily new LummaC2 infections (Source: Trevor Hilligoss)
<h2>How to protect yourself against infostealers</h2>
The threat from infostealers will remain very real for the foreseeable future and continue to adapt. Oftentimes, stealers are used in indiscriminate campaigns. Additionally, the sheer volume of data that has been dumped on the internet is immense. That means anyone is fair game and should take action to protect themselves following that assumption that they could be targeted. 
<ul>
 <li>Use strong, unique passwords for every account. This will prevent credential stuffing attacks, which is a common tactic where threat actors insert stolen usernames and passwords. That way, if one password is exposed, it won&rsquo;t give access to all your other accounts where you reuse the same password. Also, consider using a password manager to securely and conveniently store them.</li>
 <li>Enable MFA on your accounts. While this measure isn&rsquo;t failproof on its own, it adds an additional layer of defense and makes you a harder target.</li>
 <li>Be on guard for phishing attempts. Infostealers often spread through phishing emails and malicious downloads. </li>
 <li>Check HaveIBeenPwned to monitor potential exposure if you&rsquo;re worried you may have been infected by an infostealer. </li>
</ul>

What the Lumma stealer takedown means for the infostealer market and your personal data

Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkey vs Password: Which is More Secure? | LastPass

Explore the differences between passkeys and passwords. Learn how LastPass enhances security and simplifies access with advanced authentication methods.

Blog

Blog

Recent

Industry News

Cybersecurity

LastPass For Admins

LastPass Labs

Product Updates

Tips And Tricks