Get LastPass Free

Create and store secure passwords for yourself, your team or business.

Why LastPass?

Remember fewer passwords and log in faster with our browser extension.

How LastPass works

LastPass zero-knowledge security model keeps your data private even from us.

Security Architecture

Compare LastPass competitors, plans, and features in one place

Compare LastPass

Overview

Password management

Save and autofill

Password generator

Password sharing

Passkeys

Dark web monitoring

Security dashboard

Key Features

Free LastPass Premium trial, no credit card required.

Free LastPass Business trial, no credit card required.

Let our experts help you find the right plan and successfully deploy LastPass.

Sync passwords across all devices, monitor password health, data breaches and much more.

Personal

Premium password management for family or group of 6 people.

Families

Personal Plans

Password vault

Save &amp; autofill

Mobile Smart Scanner

Automatic device sync

Emergency access

Personal password sharing

FOR INDIVIDUALS

30-day free LastPass Premium trial, no credit card required.

30-day free LastPass Families trial, no credit card required.

Limited to 1 device type and basic password management features.

Designed for businesses of all sizes, from small startups to enterprises.

Business

Simplify secure access straight from the browser with more admin control.

Business Max

For single teams just getting started with password management.

Teams

Designed to keep your clients&#39; credentials protected and private.

Business Plans

User management

SaaS Monitoring

SaaS Protect

Secure Access Essentials

Business sharing

Multifactor Authentication

Integrations

Single Sign-on

Identity management

For admins

Marketing teams

Legal teams

HR teams

Business leaders

IT admins

Solutions by role

Case studies

Webinars

Product demos

Events

Trust Center

Compliance Center

Security architecture

LastPass University

Resource Center

Pricing

Join the LastPass Partner Program to provide even more value to your customers.

Partner program overview

Managed Service Providers

Resellers

Cloud marketplaces

Technology Alliance Partners

LastPass Partner Program

Grow new revenue streams by meeting customer&#39;s security needs.

Looking for help or interested in becoming a LastPass partner? Get in touch with our partner team.

Connect with trusted LastPass Partners to support your security needs.

Partners

Self-service library of resources and guides for all LastPass products.

Support Center

Community forum

System status

Help

Personal support for all LastPass’ subscribed customers.

Support

Get LastPass free

Submit sales inquiry

Chat with sales

Request a demo

Find a partner

Contact sales

Log in

Top Cyber Threats of 2026: Insights from LastPass Phish Bowl Live

Explore the latest threat intelligence from LastPass experts in their live webinar session, covering AI-powered attacks, credential theft, phishing trends, infostealers, and practical security recommendations for businesses.

The Phish Bowl: AI, Identity, and Emerging Threats — Webinar recap & resource guide

LastPass Threat Intelligence, Mitigation, and Escalation (TIME) would like to alert our customers to an active phishing campaign identified on July 13, 2026. Phishing emails are being sent from hello@lastpassnewsletter.com with the subject line shown below, directing recipients to a fraudulent site likely designed to steal LastPass master passwords.
This is likely an attempt on the part of a threat actor to generate urgency and trick customers into handing over their credentials, which is a common social engineering tactic. LastPass systems are not affected.
&nbsp;
Campaign Overview
The attacker registered two lookalike domains, lastpassnewsletter[.]com and lastpasscompliance[.]com, neither of which is affiliated with LastPass in any way. Emails sent from hello@lastpassnewsletter.com are designed to look like an official LastPass security notice, instructing recipients to review updated security policies via a provided link.
<img src="https://www.lastpass.com/-/media/cf0007801c574119b9244b76379cdc95.png?h=852&amp;w=607" >
Image: Example of a phishing email sent from hello@lastpassnewsletter[.]com. 
Clicking the link directs recipients to https[:]//lastpasscompliance[.]com/, a site impersonating a third-party service and prompting visitors to download software. The site has been confirmed malicious by Microsoft Defender for Office 365 and Cloudflare. We are investigating the nature of the download and will update this post as findings are confirmed.
<img src="https://www.lastpass.com/-/media/1e8ea3f5317342f5b81d3e8de40db493.png?h=729&amp;w=1383" >
Image: The phishing link redirects targets to a landing page that impersonates DocuSign. 
The phishing site has been independently classified as malicious by Microsoft Defender for Office 365, which blocks the URL via SafeLinks, and by Cloudflare, which is currently serving a "Suspected Phishing" warning to anyone who navigates to the domain. 
We are working with our partners to have these domains taken down as quickly as possible.
Known Sender and Subject Line
From:
hello@lastpassnewsletter.com
Subject:
Action Required: Review Updated LastPass Security Policies
What to Do
Please remember that no one at LastPass will ever ask for your master password.
If you received this email:
<ul style="margin-top: 0in; list-style-type: disc;">
 <li>Do not click any links in the message.</li>
 <li>Do not enter your credentials on any site you reached from this email.</li>
 <li>If you did enter your master password on the phishing site, change it immediately from a trusted device at <a href="https://www.lastpass.com/">LastPass.com</a> and review your vault for any unexpected activity.</li>
</ul>
As always, if you are ever unsure whether a LastPass-branded email is legitimate, please submit it to abuse@lastpass.com. We would like to thank the customers who have already flagged this campaign for their vigilance.
&nbsp;
<h2>Indicators of Compromise</h2>
Malicious domains at time of publication:
<ul>
 <li>lastpasscompliance[.]com &mdash; phishing site impersonating a LastPass account portal
 <ul>
 <li>Serving IP: 34.132.187.133 (Google Cloud Platform)</li>
 </ul>
 </li>
 <li>lastpassnewsletter[.]com &mdash; fraudulent sending domain used to deliver phishing emails
 <ul>
 <li>Sending IP: 54.240.9.8 (Amazon SES)</li>
 </ul>
 </li>
</ul>
Sender address:
<ul>
 <li>hello@lastpassnewsletter[.]com</li>
</ul>
Subject line:
<ul>
 <li>Action Required: Review Updated LastPass Security Policies</li>
</ul>
SHA256 artifact hash:
<ul>
 <li>8ae49ed3cb1e076fd12eb1f5489f1be0c9be4264731b3afd4175cf3284bc1b79 
 <div>&nbsp;</div>
 </li>
</ul>
This post will be updated as new information becomes available. For questions or to report a suspicious email, contact <a href="mailto:abuse@lastpass.com">abuse@lastpass.com</a>.

LastPass Threat Intelligence, Mitigation, and Escalation (TIME) would like to alert our customers to an active phishing campaign identified on July 13, 2026. LastPass systems are not affected.

LastPass alerts customers to active phishing campaign using lookalike domains; no impact to LastPass systems

Klue Supply Chain Incident & LastPass Response

LastPass wants to inform our customers of a security incident which recently occurred at one of our third-party suppliers and how that incident impacts LastPass and our customers.

“Well, We Had a Good Run”: Thinking About Cyber Threats in the Age of AI, Part 2: Threats TO AI

This article is the second part of our series examining how to frame the cyber threat environment in relation to artificial intelligence (AI). The previous blog post in this series was about threats FROM AI, while this article examines threats TO AI, specifically why companies’ usage of AI presents a unique threat model for defenders to consider and a desirable target for threat actors. 

“Well, We Had a Good Run”: Thinking About Cyber Threats in the Age of AI, Part 2: Threats TO AI 

A lot of ink has been spilled on AI threats over the last few years and with good reason. AI is undoubtedly changing the cyber threat landscape in ways positive and negative. <a href="https://www.anthropic.com/glasswing">Anthropic&rsquo;s announcement of Project Glasswing</a> this week is a great example of a positive way (for now) AI is helping keep organizations more secure as major companies like Google, Apple, Anthropic, and NVIDIA band together to use Claude Mythos2 to scan for vulnerabilities across critical software in a responsible manner. Are there concerns this capability can and will be replicated by less responsible organizations and malicious threat actors to identify and exploit vulnerabilities before they are patched? Absolutely, but we&rsquo;ll get to that another day. For now, let&rsquo;s focus on the topic of AI threats and how to frame them in a way that is manageable, particularly for small and midsized businesses that may be overwhelmed by the sheer volume of threat reporting out there. This post will be the first in a series on how to think about AI threats that will help organizations frame these issues in a way that will allow them to parse out what&rsquo;s noise and what needs action and what can be done about it. 
For this first piece, let&rsquo;s focus on breaking down &ldquo;AI threats&rdquo; into two subdivisions&hellip;threats TO AI, which we will address in future posts, and threats FROM AI, which is what the majority of current cybersecurity media reporting is currently focused on. These threats generally fall into a few major categories; examples of these include: 
<ul style="list-style-type: disc;">
 <li>Phishing: &ldquo;AI-enabled phishing&rdquo; served as the bow wave of AI threats. This started largely as phishing campaigns using AI to draft higher quality emails, devoid of the typical spelling and grammar mistakes that served as the hallmark of spam for decades, before evolving to include AI-driven reconnaissance and spearphishing that enabled the creation of more targeted messages and campaigns at a larger scale. This has now progressed to the creation of whole phishing kits enabled by AI, including writing the code for interstitial (referral) pages, security research detection and obfuscation measures, and the creation of custom phishing pages. The LastPass Threat Intelligence team assesses we have seen this last phase of activity in phishing campaigns targeting our own customers, in fact. </li>
 <li>Malware Development: The use of AI to improve and even develop new and custom malware has been a long-standing concern and one that has borne out over the last few years. Threat actors are either developing unique and malicious large-language models (LLMs) to help them with this or finding ways to jailbreak legitimate models to assist in the creation and/or improvement of malware. Reports from major AI companies <a href="https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf">such as Anthropic</a> confirm these efforts and again, our own analysis has uncovered indicators of AI involvement in the creation of custom phishing kits which, while not malware per se, demonstrate the use of AI to create code with malicious intent.</li>
 <li>Deep Fakes and Disinformation: This category refers to the use of AI to generate deliberately misleading written, audio, or video material. The use of deep fakes has long been a concern but is becoming more of a reality in cyber attacks targeting organizations, most notable in recent campaign by North Korea in which nation-state cyber threat actors leverage deep fakes of whole teams to arrange virtual meetings with individuals generally with goal of compromised their machine and/or network to enable further attacks targeting credentials, tokens, and/or cryptocurrency. The recent supply chain attack <a href="https://github.com/axios/axios/issues/10636#issuecomment-4180237789">targeting the Axios software on npm</a> is a great example of this. </li>
 <li>Increased Speed and Scale of Operations: Just as many people are, cyber threat actors are using AI (particularly agentic AI) to automate their operations, allowing them to plan and execute their attacks at unprecedented speed and scales. A <a href="https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf">separate Anthropic report from last November</a> detailed an extensive cyberespionage campaign linked to Chinese nation-state threat actor that was orchestrated by AI and since then, there are increasing indications these approaches are being leveraged by a broader range of threat actors. </li>
 <li>Lowered Technological Barrier of Entry: &ldquo;Vibe coding&rdquo; isn&rsquo;t just for people looking to create their killer app&hellip; cyber threat actors are doing it, too. The derisive terms &ldquo;script kiddies&rdquo; or &ldquo;skiddos&rdquo; have been around in cybersecurity forever, referring to individuals using simple techniques or scripts to attempt to conduct cyber attacks&hellip; for a long time, this was largely a nuisance issue, particularly for well-defended organizations. Now, however, AI is allowing &ldquo;n00bs&rdquo; to pose legitimate threats as they are able use AI tools to create and launch various attacks, similar to what we discussed above. When these &ldquo;&rsquo;bad vibe&rsquo; coding&rdquo; attacks are combined with the larger &ldquo;evil-as-a-service&rdquo; cybercrime ecosystem (ransomware-as-a-service, phishing-as-a-service, etc.), these relatively unsophisticated threat actors become serious concerns that can punch well above their weight. </li>
</ul>
This list is by no means exhaustive but it does demonstrate the threats organizations are facing FROM AI&hellip; in other words, those threats that are enabled by AI. The good news is that while these threats generate a lot of reporting, for the most part, existing controls when well-implemented can mitigate much of the threat from these. Remember, the TYPES of attacks associated with the points above aren&rsquo;t fundamentally different from what existed previously, it is HOW they are creating and conducting them that is largely changing. I would argue the largest shift on this front right now is the last bullet point: the threat environment is growing because just about anyone with a computer and a bad attitude can now jump into the cybercrime ecosystem, which means there are MORE attacks to worry about. But again, passwords, MFA, passkeys, patching, and other basic cyber hygiene measures can address most of these concerns. 
Stay tuned as we move on in this series&hellip; next up, we will start to dig into threat TO AI, starting with a look at why the use of AI by organization creates a unique threat model and how to frame these threats in a way that can help you address them in an organized and methodical manner.

Thinking About Cyber Threats in the Age of AI

This blog post focuses on the topic of AI threats and how to frame them in a way that is manageable, particularly for small and midsized businesses that may be overwhelmed by the sheer volume of threat reporting out there. This post will be the first in a series on how to think about AI threats that will help organizations frame these issues in a way that will allow them to parse out what’s noise and what needs action and what can be done about it. 

“Well, We Had a Good Run”: Thinking About Cyber Threats in the Age of AI, Part 1: Threats FROM AI

LastPass&nbsp;Threat Intelligence, Mitigation, and Escalation (TIME)&nbsp;would like to alert our customers&nbsp;to&nbsp;an&nbsp;active&nbsp;phishing campaign that&nbsp;began on or around March 1, 2026. These&nbsp;phishing emails are&nbsp;being sent&nbsp;from&nbsp;several&nbsp;email addresses&nbsp;with&nbsp;various&nbsp;subject lines that look like forwarded internal messages about unauthorized access to individuals&rsquo; accounts. The known list of email addresses&nbsp;and subject lines can be found below.&nbsp;&nbsp;&nbsp;
This is an attempt on the part of a malicious actor to draw attention and generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails.&nbsp;
<h3>Campaign Overview</h3>
Attackers are forwarding fake email chains to make it appear as though another individual is trying to take unauthorized action on their LastPass account (i.e., export vault, full account recovery, new trusted device registered, etc.). Attackers use display name spoofing so that the name portion of the sender field is manipulated to impersonate LastPass, while the actual sending email address is unrelated. The attacker relies on the fact that many email clients (especially mobile) show only the display name, hiding the real sender address unless you expand it. The emails instruct targets to take some type of action (i.e., report suspicious activity, disconnect and lock vault, revoke device, etc.) if something looks off via provided links; these links then direct targets to fake SSO login pages via https[:]//verify-lastpass[.]com as the primary URL to collect users&rsquo; credentials (see below).
<h3>Body of Phishing Email Examples</h3>
The below images shows the fake correspondence and personas the threat actor included in emails to targets.
<img src="https://www.lastpass.com/-/media/5b579a58cf254b069d6f9abc6b793810.jpg?h=312&amp;w=936" >
<img src="https://www.lastpass.com/-/media/2677d3c9576148cd97e6bb42208a574c.jpg" >
The image below displays the landing page that is a fake LastPass SSO login page. 
<img src="https://www.lastpass.com/-/media/228a483228a6447b8d99bb6397445f6a.jpg" >
&nbsp;
<h3>What to do </h3>
Please remember that no one at LastPass will&nbsp;ever ask for your master password.&nbsp;Rest assured,&nbsp;we are&nbsp;working&nbsp;with our third-party partners&nbsp;to have these sites taken down&nbsp;as soon as possible.&nbsp;In the meantime,&nbsp;please&nbsp;take the&nbsp;appropriate precautions&nbsp;and,&nbsp;as always, if you&nbsp;are ever unsure whether&nbsp;a&nbsp;LastPass branded&nbsp;email is&nbsp;legitimate, submit&nbsp;it to&nbsp;<a href="mailto:abuse@lastpass.com">abuse@lastpass.com</a>.&nbsp;We would like to thank our customers who have already&nbsp;submitted&nbsp;this email for their vigilance and&nbsp;commitment to keeping our community secure.&nbsp;
&nbsp;
<h3>Indicators of Compromise</h3>
Malicious URLs and associated IP addresses at time of publication:&nbsp;&nbsp;
At the center of the phishing chain is the domain https[:]//verify-lastpass[.]com. Most malicious links redirect to this domain, but the attackers generate many slightly modified versions by adding different trailing numbers. This lets them produce a large set of URLs that all resolve to the same phishing page.
<ul>
 <li>http[:]//url6163[.]hancochem[.]at/ls/click?upn=u001.zzKoeZ0KJwWxkAal-2BAEGAVZqjLZ-2Fi-2FvLLleyd0Mrg7G2tDUVYJx-2BwoTtA3VLtDQxDdnbMlSxrd48X2rqT3qjwA-3D-3D4tgO_sO-2BxZceWa0lJwX67h1R3P4373GdGx0dFRW1jYvRsz0zpAChfojQaxq2-2Bkg5LzfoxWNcUnJJfqqvxD7hQYHhN-2FI-2BPE3Xav0OFz-2FYfkten1SK5CpICpFh-2FePosONfhxOeAEuJOM6ptlTgkAjbq7cEdRaO5VlNg1llTkcEPO3z5AI0k9UpvVGTAzLPy2F5XkI2ozYLJlUrGPCZ-2F-2FB-2F1EZpCXWdDXN70q14FYvRYyMptdqWq4DhdemtpUyZ6Bmfl9JRinCHKTAB32JnuxqmjamSwTQ-3D-3D
 <ul>
 <li>Redirects to https[:]//verify-lastpass[.]com/login?13</li>
 <li>Serving IP address:&nbsp;172.67.200[.]82</li>
 </ul>
 </li>
 <li>http[:]//email[.]mg[.]atomicminerals[.]ca/c/eJxszE1SwyAUAODTPJbM4_1AsmBRx8kJ3LgklKQ4IdUEO-rpvUAv8F1j8MLJmRJdCMRevARzizroUhafVa_jQPOsWgRLDqgJacloaiQkj4zOOUYJdhkppJFRWTxiURBsq0393mpudS9H2k6bk9nirffPE_gCNAFNc-12-wWa5KD3t3oBnn4yAvkH8OszAcjvwzr8mSOe3x9px9GRMNDLFwiuLdXN5nszj0j_AQAA__9YskAN?px7ik70&amp;r=salud5i.cl&amp;6
 <ul>
 <li>Redirects to https[:]//verify-lastpass[.]com/login?14</li>
 <li>Serving IP address:&nbsp;172.67.200[.]82</li>
 </ul>
 </li>
 <li>https[:]//u48791940[.]ct[.]sendgrid[.]net/ls/click?upn=u001.ogpCsZrycFMCzfAiwPUWLmFsdkeI0MdEubFNgF3jgfqNQnFF7Sa4GacvI70clegZr1qhygt4EWt2YnP-2FiRMmaw-3D-3D5DWs_J8xRVsYbQP5fs7rIap1JbiZonM0buqGmCHMV-2BEiWHGtUxzu1WAuzO-2F7r3H3eREXp7XzUO3kzMmDj-2FdV-2F-2B4uWrIiJutCCPJ7YwmWdBDCht1WbPrgl1ya8BLo-2FkUCBo2UB47GOty9-2BpwLA0VbNvHAyb0HBKx8PxXXUIXmB-2BtJj5jHoGWLDU-2Fzhub-2F5uJgsSK4tOiGznacs1i4gOiTZYqi69QVYnU0ickYbRu9-2BQYsVwZ3Q-2B9-2Bb-2FidY2lMaojEQ4-2FdBB2GtXwZ6LtDo7p8V7d8WbA-3D-3D
 <ul>
 <li>Redirects to https[:]//verify-lastpass[.]com/login?12</li>
 <li>Serving IP address: 104.21.21[.]204</li>
 </ul>
 </li>
 <li>https[:]//u44889439[.]ct[.]sendgrid[.]net/ls/click?upn=u001.e-2BxTnSnQxOkncC20jNBuK6V4isKkl0XRDY4tivVdQQeqb6mLeZ9KZOFcqWpx39-2BnAE7mTDuZrA1c4CRwWnQJ87meMHF8VOjaNNH6wrLM3tM-3Dy3Wh_R1ZGbWCmLkaPZePSUmyQqgC1d5Ris5WwQ8-2BSDU4d1rdH8zGcPFFH4qlT8e5nEVVXDsX1sxkOVJGJxV2k3mwe-2FKfUVjKWBXPNmt-2BaH9C1gryEyEFxqdI02G0RJDIFrE6Nl4-2FW-2BO2bPI3S5k-2B-2FPb-2FQa5gviNQAk-2BIEXw6VHumTQbE6UHjUDbxJtHf1MonzbXBm5LIlU94C72GVqQpgivP2zmV1UE4e6UHNrQ0EU5kDakI-3D&amp;t3fq0mvk&amp;ref=deepai.cloud&amp;4yo7x
 <ul>
 <li>Redirects to https[:]//verify-lastpass[.]com/login?6</li>
 <li>Serving IP address:&nbsp;52.102.103[.]4</li>
 </ul>
 </li>
 <li>https[:]//u36129518[.]ct[.]sendgrid[.]net/ls/click?upn=u001.-2FOOkSPOOOLb9fpU79r0i5hEcjwfSQiTuVvlEgaG0hdHfvF0xmyV5ce3B4o7gGe0pUsHKDoF5ZYs1K2zEXVW9W-2F-2FdlazaOb4E5L8fdeTHrCk-3DEvrg_VBVoDhnIQxvCgpmdePRMMhkot7dkZlCJbRS3wbJOKNEIgFbdWxk02jlIRoEXWYDG-2Bu4QKAwbK0S7QyfOm51-2BaKSgcUhp9gIwP4JXcoWFOwS0EnG5t4esWxYDCzC0DArn6LAgJii-2F9ue3VcvjeqWEd6mhs3U83u8F7JNRQ94Icqdz466gV-2Fii3l-2B6SoPa9U0nLdiYN8Cfi381AtC6Kbro0T5nqaadfqtHC7xucIF3oGsjsHvz0ciYZ9bzxeP-2F6PpUrJifffYMQ4ROnoVh6uwC1g-3D-3D
 <ul>
 <li>Redirects to https[:]//verify-lastpass[.]com/login?14</li>
 <li>Serving IP address: 104.21.21[.]204</li>
 </ul>
 </li>
 <li>https[:]//u8790117[.]ct[.]sendgrid[.]net/ls/click?upn=u001.orExwStHYFDTU74GY1XA46huRVGl2xzICxrswbVNw6-2FtS6SAKtxwYwh83Ym-2FDWqHZcYQZJ-2FDSlAUAmoE8yFV0g-3D-3D6eeu_M-2Bd3xd1fzoxjC4kCStlaly-2FJia50cDswk4hS8HhdkZh4BaY2qwomdnOk9fz6pJQemyQsO5BiLR7Pcsr-2FFbAJeMmvGC-2FfI6pVbMaYAEYM-2B9xlijEYZ-2FdfUqJ5M4A6yAWTuHXacxHZX1hFEZJbjAKDus-2BqrDAGnOgWsIEabTDSyUaIqjQTLGTQikLOGwG5xj7wL3Wer5kxEXBuSuao3w4vxg-3D-3D&amp;sq9fhcx&amp;origin=fluxstore.io&amp;i
 <ul>
 <li>Redirects to https[:]//verify-lastpass[.]com/login?13</li>
 <li>Serving IP address: 52.102.103[.]12</li>
 </ul>
 </li>
 <li>http[:]//email[.]mg[.]79resources[.]com/c/eJxkzU1OwzAQQOHTjJfR_DjjeOEFFcoJWCA2yLWdNlKsQuxUKqdHwJIDvPfl4P0YJzYlkHMsap2guQaenJRl0ZKTiBKmnEgJeUTKGhnNGhhZUZCIhAkHH_PZeTsVR8tiMYLFehmc30u7HXsqbUi3arZw7f2jgTwBz8Dzee3D9gCebX99e4knkDlV-2VlA9aj1_e_GOT5_wxY24PuZg-H-JFF0QGfSvv8sS81rtsveQ_8HQAA__-ytUM_?ci&amp;tag=yodhafinance.com&amp;vtzlng
 <ul>
 <li>Redirects to https[:]//verify-lastpass[.]com/login?11</li>
 <li>Serving IP address: 104.21.21[.]204</li>
 </ul>
 </li>
 <li>http[:]//email[.]mg[.]redlakegold[.]ca/c/eJxky0FOxSAQANDTDEsCw3ToX7DQmK69Agy0JR_8TYsm9fQewAO8HCinPKEqwXqPjokfpPZgKGUxiT3LTDKjnfL6KKvEKOQFk6oBDbJxxlrrrCNNzgoyz1OcVo6-AJm-6bPkFp9le7WsJaoW9jGOC9wb4AK4pDp0uwEXOsvv8XmDW-QA5AHu478-w12uXr9k_-7PagHfOQGZrcfatLy6-gn4FwAA__9PZD7G?g2fk3tf3&amp;tag=bebran.com&amp;bd
 <ul>
 <li>Redirects to https[:]//verify-lastpass[.]com/login?6</li>
 <li>Serving IP address: 52.102.103[.]50</li>
 </ul>
 </li>
 <li>http://email.mg.redlakegold.ca/c/eJxky0FOxSAQANDTDEsCw3ToX7DQmK69Agy0JR_8TYsm9fQewAO8HCinPKEqwXqPjokfpPZgKGUxiT3LTDKjnfL6KKvEKOQFk6oBDbJxxlrrrCNNzgoyz1OcVo6-AJm-6bPkFp9le7WsJaoW9jGOC9wb4AK4pDp0uwEXOsvv8XmDW-QA5AHu478-w12uXr9k_-7PagHfOQGZrcfatLy6-gn4FwAA__9PZD7G?bwu71&amp;utm_source=bebran.com&amp;2nxq14
 <ul>
 <li>Redirects to https[:]//verify-lastpass[.]com/login?6</li>
 <li>Serving IP address: 104.21.21[.]204</li>
 </ul>
 </li>
 <li>http[:]//email[.]mg[.]bedfordmetals[.]com/c/eJxszUtuwyAQANDTDEuL-TCGBYtWFfcwv8QSKGniWM3tK3XdC7xXoy_sVjIt4roSq6hXc43StInNnXLDECg7rtVTdyVj7pjZ7JEsqWWLiIykS5cSmvMSNtfRFwGx87LkVvvtUWc7tvFcym2aEa_HcX8CfwAloJT3YxlvoCRDbNo34PRd5vvn7EB6An_9pwDp3Tzii4MjVrsCfb4YxF7mto-_5oz0GwAA__-9fkCb?8v&amp;v=itpbusa.com&amp;jat472k
 <ul>
 <li>Redirects to https[:]//verify-lastpass[.]com/login?5</li>
 <li>Serving IP address: 104.21.21[.]204</li>
 </ul>
 </li>
 <li>http[:]//email[.]mg[.]bedfordmetals[.]com/c/eJxszUtuwyAQANDTDEuL-TCGBYtWFfcwv8QSKGniWM3tK3XdC7xXoy_sVjIt4roSq6hXc43StInNnXLDECg7rtVTdyVj7pjZ7JEsqWWLiIykS5cSmvMSNtfRFwGx87LkVvvtUWc7tvFcym2aEa_HcX8CfwAloJT3YxlvoCRDbNo34PRd5vvn7EB6An_9pwDp3Tzii4MjVrsCfb4YxF7mto-_5oz0GwAA__-9fkCb?8v&amp;v=itpbusa.com&amp;jat472k
 <ul>
 <li>Redirects to https[:]//verify-lastpass[.]com/login?5</li>
 <li>Serving IP address: 172.67.200[.]82</li>
 </ul>
 </li>
</ul>
Sender email information:&nbsp;
From:&nbsp;&nbsp;
<ul style="margin-top: 0in; list-style-type: disc;">
 <li>office@hancochem.at</li>
 <li>admin@salud5i.cl</li>
 <li>no_reply@remstal-praxis.de</li>
 <li>demo@fluxstore.io</li>
 <li>no_reply@kreducationsa.com</li>
 <li>support@yodhafinance.com</li>
 <li>hr@bebran.com</li>
 <li>info@itpbusa.com</li>
</ul>
Subjects:&nbsp;
<ul>
 <li>Re: the details</li>
 <li>Re: pending approval</li>
 <li>Re: Access request pending</li>
 <li>Re: FYI</li>
 <li>RE: sign-in &mdash; TRZ-2302300</li>
 <li>Fwd: Re: your request</li>
 <li>Re: credential download</li>
</ul>

March 2026 Phishing Campaign Targeting LastPass Customers

LastPass Threat Intelligence, Mitigation, and Escalation (TIME) would like to alert our customers to an active phishing campaign that began on or around March 1, 2026. These phishing emails are being sent from several email addresses with various subject lines that look like forwarded internal messages about unauthorized access to individuals’ accounts. The known list of email addresses and subject lines can be found below. This is an attempt on the part of a malicious actor to draw attention and generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails. 

LastPass Alerts Customers of Fake Email Chains Used in New Phishing Campaign; No Impact to LastPass Systems

Digital squatting and phishing are often treated as separate threat vectors, but they are deeply intertwined. Digital squatting is an umbrella term for various deceptive tactics that aim to capitalize on established brands and differ in their specific techniques. If phishing is the scam message, then digital squatting is the trap. Phishing convinces the victim to click. Digital squatting gives them a believable place to land and unknowingly hand over credentials and other sensitive information. 
These attacks are indiscriminate and take advantage of a huge attack surface that is nearly impossible to stay ahead of. Especially now that automation and AI have entered the group chat, it&rsquo;s like forcing security teams into a one-on-one defense scenario where the adversary has endless stamina, instant playbooks, and the ability to change tactics in real time.
Together, digital squatting and phishing can form one of the most successful, scalable, and low-cost social engineering attack chains used by cybercriminals. Here&rsquo;s how they connect.
<h3>Digital squatting creates fake websites that look real. </h3>
Fake and lookalike domains are the front end of modern attacks.&nbsp;They&rsquo;re&nbsp;used to deliver phishing, malware, and business email compromise, often bypassing&nbsp;traditional perimeter defenses because the infrastructure lives outside the company&rsquo;s network.&nbsp;
Cybercriminals use fake domains because&nbsp;they&rsquo;re&nbsp;one of the most efficient ways to steal credentials without touching a company&rsquo;s network.&nbsp;Attackers register web addresses that look almost identical to companies&rsquo; real sites&mdash;sometimes with just one letter changed. They then use these lookalike websites to fool employees or customers into thinking they&rsquo;re interacting with your business. Given the massive attack surface, brands cannot defensively register everything, which leaves the doors open to attacks.
Common tactics to make websites appear legitimate include the following:
<ul style="list-style-type: disc;">
 <li>Typosquatting: registering commonly misspelled brand names (i.e, gogle[.]com&nbsp;instead of&nbsp;google[.]com)</li>
 <li>TLD Abuse: substituting top-level domains (i.e., &ldquo;google.co&rdquo; instead of &ldquo;google.com&rdquo;)</li>
 <li>Homograph attacks: character swaps like replacing similar-looking numbers,&nbsp;letters,&nbsp;foreign alphabets,&nbsp;punycode, and more</li>
 <li>Combosquatting: adding keywords like &ldquo;support,&rdquo; &ldquo;secure,&rdquo; or &ldquo;login&rdquo; to the real brand name (i.e.&nbsp;&ldquo;secure-bank.com&rdquo;)</li>
</ul>
<h3>These fake sites make phishing attacks far more convincing.</h3>
These attacks are particularly effective because they use social engineering elements to bypass security safeguards.&nbsp;Instead of obvious scam links, attackers send emails or texts that appear legitimate because the link looks like a real domain. Attackers hope victims&nbsp;don&rsquo;t&nbsp;notice misspelled domains that appear similar to trusted brands, or&nbsp;maybe&nbsp;it&rsquo;s&nbsp;difficult to see the entire URL before clicking on it from a mobile device.&nbsp;Employees see what their eyes expect and click without hesitation. If attackers can impersonate your brand, they can target your users without ever touching your systems.&nbsp;
Digital squatting&nbsp;isn&rsquo;t&nbsp;just about tricking&nbsp;computers &ndash;&nbsp;it's&nbsp;also about manipulating human trust at scale.&nbsp;This tactic&nbsp;works because it turns human behavior into the attack surface, taking advantage of our trust in brand credibility and familiarity. Combine a perfect email with a perfect-looking website, and the scam becomes extremely believable.
<h3>It takes only one click to have devastating consequences. </h3>
Even one employee entering credentials into a fake website can give attackers email access, customer and/or corporate data, billing credentials, or cloud platform access. One compromised account can cascade quickly. 
For instance, security researchers <a href="https://cybersecuritynews.com/scattered-lapsus-hunters-registered-40-domains/">discovered over 40 typosquatted Zendesk domains</a> such as znedesk[.]com and vpn-zendesk[.]com, crafted to mimic real Zendesk login portals. These fake sites hosted fraudulent single sign-on (SSO) pages specifically designed to steal credentials. Victims were often lured through phishing emails, fraudulent support tickets linking to the fake domains, and login prompts that captured credentials before redirecting. This campaign aligns with earlier Scattered Lapsus$ attacks against Salesforce using similar typosquatted infrastructure.
<h3>How are attackers are using digital squatting to target brands and users? </h3>
This attack&nbsp;generally involves&nbsp;luring victims to a fake&nbsp;lookalike&nbsp;site&nbsp;hosting a cloned real login page. When users enter their usernames and passwords, the&nbsp;attacker&nbsp;captures them in real time, and the victim is often redirected to the real site&nbsp;to avoid raising any suspicions. Modern fake-domain kits now&nbsp;allow attackers to capture MFA tokens or session cookies and proxy logins in real time.&nbsp;
Digital&nbsp;squatting&nbsp;isn&rsquo;t&nbsp;a new tactic, but AI is evolving it faster and at greater scale than ever before.&nbsp;The recent uptick in digital squatting is&nbsp;directly linked&nbsp;to the commodification of cybercrime through Generative AI (GenAI) and autonomous attack agents. These technologies have enabled threat actors to scale the creation and management of malicious domains at an unprecedented rate.&nbsp;AI-driven&nbsp;digital&nbsp;squatting&nbsp;makes it cheap and fast to generate thousands of believable domain variations, create polished phishing sites and emails, and scale attacks.&nbsp;For instance, threat actors are&nbsp;utilizing&nbsp;both legitimate Large Language Models (LLMs) and purpose-built "Dark LLMs" to automate the squatting lifecycle.&nbsp;&nbsp;
<h3>How LastPass can help prevent fall out from these attacks?</h3>
The LastPass TIME team&nbsp;regularly monitors for phishing campaigns&nbsp;leveraging&nbsp;our branding&nbsp;targeting LastPass customers. When it pops up, we work&nbsp;to quickly take down and&nbsp;publicly&nbsp;report&nbsp;this activity as soon as&nbsp;it&rsquo;s&nbsp;detected.&nbsp; 
Credential theft rose 160% in 2025, and the fastest-growing tactic behind that surge is deceptively simple. As mentioned, attackers are creating fake versions of legitimate sites with URLs that are engineered to trick your eyes, especially when you're busy or distracted. But here's what makes LastPass your ally: it helps you catch the trick. Via domain binding, LastPass "binds" your credentials to the exact domain where you created them. This means it autofills your information on sites it recognizes.&nbsp;It helps you outsmart digital squatting scams, even if a site looks perfectly familiar to you. LastPass is a defense that helps you stay safe even on your worst, most distracted day. <a href="https://www.lastpass.com/trial/business?max=true">Try LastPass today</a> to start protecting yourself now. 
<h3>What practical steps can&nbsp;SMBs take to protect themselves from digital squatting&nbsp;scams?&nbsp;</h3>
The faster organizations&nbsp;identify&nbsp;and disable digital squatting campaigns, the more effectively they can protect credentials and control risk. Here are a few simple steps SMBs can take to better protect themselves against these threats: 
<ul style="margin-top: 0in; list-style-type: disc;">
 <li>Register obvious variations of your domain (cheap and effective).</li>
 <li>Enable MFA everywhere (cuts off most credential theft).</li>
 <li>Use email security tools that check for lookalike domains. Tools&nbsp;like DNS firewalls&nbsp;can automatically block employees from visiting risky websites,&nbsp;especially brand-new or suspicious lookalike domains.&nbsp;&nbsp;</li>
 <li>Train employees to hover over links before clicking and check whether they are legitimate.</li>
 <li>Monitor for new domains impersonating your brand. Early alerting and rapid takedown procedures are essential to limit the dwell time of malicious infrastructure.&nbsp;</li>
 <li>Shadow AI visibility is a growing concern.&nbsp;Monitor&nbsp;internal use of AI tools to prevent data leaks that provide attackers with the specific keywords or document naming conventions or system mapping they need to create highly effective impersonation domains. Shadow AI leaks more than people realize by quietly teaching outsiders how your organization works without having to hack systems. If employees paste&nbsp;real internal&nbsp;content into AI tools, that can reveal naming conventions for systems and documents, folder structures, and more that can be&nbsp;leveraged&nbsp;in digital squatting and other social engineering attacks.&nbsp;</li>
</ul>

Why Digital Squatting Still Works in 2026—And Why Defense Is So Hard

Together, digital squatting and phishing can form one of the most successful, scalable, and low-cost social engineering attack chains used by cybercriminals, according to Cyber Threat Intelligence analyst Stephanie Schneider. 

January 2026 Phishing Campaign Targeting LastPass Customers [FEBRUARY UPDATE]

A third wave of phishing emails using similar tactics has been sent from the same threat actors on January 19. 

It&rsquo;s the start of a new year, which means its time for two things: 1) People are (hopefully) sticking to their New Year&rsquo;s resolutions; and 2) We&rsquo;re heading into Data Privacy Week, an international effort led by the National Cybersecurity Alliance to help individuals and businesses take control of their data. In 2026, controlling your data increasingly comes down to controlling identity. Stolen credentials, password reuse, MFA fatigue, and social engineering are now the primary ways attackers get in&mdash;not by breaking systems, but by persuading people. That shift is also changing how cybercriminal groups operate. One of the clearest examples is a loose ecosystem known as Scattered Lapsus$ Hunters. This group targets a wide range of organizations and relies on compromised identities, help desk manipulation, and speed.
In the latest episode of The Phish Bowl moderated by Jordan Sher, cyber threat intelligence experts Mike Kosak and Stephanie Schneider connect these dots. We&rsquo;ll talk about data privacy and why identity sits at the center of it and what groups like Scattered Lapsus$ Hunters tell us about the evolution of social engineering. And with special guest Nate Howard from Flashpoint, we&rsquo;ll look at how threat intelligence, including visibility into the deep and dark web, helps defenders spot attacks before they land.
Whether your New Year&rsquo;s resolution was to get smarter on cybersecurity, or you&rsquo;re responsible for protecting users, systems, and data without a massive security team, we&rsquo;re glad you&rsquo;re starting off 2026 on the right foot with us. Let&rsquo;s get into it.
<h2>Trinity of Chaos: Scattered Lapsus$ Hunters</h2>
<a href="https://blog.lastpass.com/posts/social-engineering">Social engineering</a> is about manipulating the human element of security. It essentially preys on basic human behavior which makes it so effective. It&rsquo;s easier to hack people than it is to hack machines. Common tactics using this technique include phishing/vishing/smishing, baiting and tailgating, and pretexting. Social engineering will almost certainly continue to be prevalent to all organizations, big and small, in 2026. 
Scattered Lapsus$ Hunters is one of the most effective cybercriminal groups excelling at social engineering to get access to accounts or networks. They were behind several recent attacks last year, including Jaguar Land Rover that disrupted the larger automotive supply chain for months with a reported loss of &pound;485 million to &pound;559 million ($637M - $736M) for Q3 2025. The attack was estimated to have a broader impact on the UK economy, potentially reaching over $2 billion.&nbsp; 
It&rsquo;s an amalgamation of three different groups that have been kicking around (<a href="https://blog.lastpass.com/posts/blocking-unauthorized-access-webinar">Scattered Spider</a>, Lapsus$, and ShinyHunters) and are part of a community called The Com where they share social engineering techniques. We can follow some of these conversations they&rsquo;re having on DDW to monitor the group&rsquo;s interests, capabilities, and infer where (which organizations or sectors) and how (with what tactics) they might strike next. 
<h2>Interview with Nate from Flashpoint</h2>
Our special guest is Nate Howard, Flashpoint&rsquo;s Senior Manager on Customer Success Team, joining us to talk about his perspectives on the deep dark web (DDW), <a href="https://blog.lastpass.com/posts/ai-supercharges-credential-harvesting">how artificial intelligence (AI) will shape cyber threats</a>, and real-world examples of how having access to intelligence can allow organizations to take proactive measures against threats. 
With roots in network engineering and a career that grew into security intelligence and digital offensive security, Nate has spent years countering threats from both sides of the wire. His deep experience across the deep and dark web provides a firsthand understanding of adversary ecosystems, emerging attack techniques, and how defenders can stay ahead. At Flashpoint, he helps support efforts that can be broken down into three pillars: 1) collecting data from across the DDW, 2) creating quality, finished intelligence products, 3) and providing services that play directly into making intelligence actionable for customers to be proactive and drive success in their own organizations. 
People see the DDW as a mysterious place, but Nate explains that it&rsquo;s actually closer to where we&rsquo;re normally operating than you might think. It&rsquo;s essentially made up of forums, blogs, and chat services that are relatively easy to find and access on a different internet via Tor. Threat actors like Scattered Lapsus$ Hunters are operating somewhat out in the open on the DDW, which gives us an advantage to monitor them (i.e., their personalities, TTPs, etc.), understand context and analysis around data, and respond proactively. 
Talking about the types of threats organizations should be most concerned with, Nate explained why agentic AI threats will continue to pose a significant threat. They allow threat actors who were not capable of certain attacks to now be able to do so and commodify those threats. AI will impact various attack types, particularly phishing and other social engineering tactics. AI will allow attackers to broaden the scale and scope of their attacks. <a href="https://blog.lastpass.com/posts/joint-report-lastpass-guidepoint-security-infostealers">Infostealers</a> and CVE volatility are other threats organizations should pay attention to, according to Nate. 
<h2>Actioning intelligence in real life: mitigating exposed employee credentials</h2>
To really drive home the point about how valuable technical data and real time access to the human side of security can be, and what you can do when you have access to it, Nate talked about a real-world example he says Flashpoint frequently delivers: mitigating exposed credentials. Due to Flashpoint&rsquo;s broad access to stealer logs, forums, and chat services, they&rsquo;re able to find employee credentials that are out there and have ability to monitor and alert an affected organization if employee credentials are compromised. This rapid alerting enables companies to act quickly to prevent data loss. 
Infostealers are frequently behind breaches, silently grabbing credentials and other sensitive information and selling or posting them online to be used in other attacks. For instance, an infostealer was behind the <a href="https://blog.lastpass.com/posts/snowflake-recap">Snowflake breach</a> in 2024, allowing attackers to take leaked credentials and login to accounts not protected with multi-factor authentication (MFA). 
<h2>Listen to the full episode&nbsp;&nbsp;</h2>
Catch the full episode and additional resources for more cyber threat insights from the LastPass Threat Intelligence, Mitigations, and Escalations (TIME) Team. 
<ul>
 <li>Listen to the full episode of The Phish Bowl wherever you get your podcasts:&nbsp;&nbsp;
 <ul>
 <li><a rel="noopener noreferrer" href="https://www.youtube.com/@LastPass/podcasts" target="_blank">YouTube</a></li>
 <li><a rel="noopener noreferrer" href="https://open.spotify.com/show/1TQiFDk9acmkfp1sTFN1yX" target="_blank">Spotify</a></li>
 <li><a rel="noopener noreferrer" href="https://podcasts.apple.com/podcast/id1828511920" target="_blank">Apple</a></li>
 </ul>
 </li>
 <li>Subscribe for monthly threat intel deep dives. </li>
 <li>Access LastPass's <a href="https://info.lastpass.com/threat-reports">Regional Report</a> for detailed analysis of recent APAC trends and activity. </li>
 <li>Check out the <a rel="noopener noreferrer" href="https://blog.lastpass.com/categories/threat-intel" target="_blank">LastPass Labs blog</a> for more insights.&nbsp;</li>
</ul>
See you back in February to talk about Europe cyber threats! 
&nbsp;

The Phish Bowl Explores How Identity is Under Attack, Scattered LAPSUS$ Hunters, and Cybercrime Trends

This article recaps the January 2026 episode of The Phish Bowl, a podcast featuring cyber threat intelligence experts diving deep into relevant cybersecurity topics. This episode covers protecting identity as a security fundamental, Scattered Lapsus$ Hunters and their social engineering tactics, and cybercrime trends. 

22 January 2026 UPDATE:&nbsp;
The&nbsp;suspected threat&nbsp;actors behind this campaign have&nbsp;sent another wave of phishing emails using similar tactics. The body of the email&nbsp;remains&nbsp;the same, but the&nbsp;links have been changed following&nbsp;LastPass&rsquo;&nbsp;disruption of their&nbsp;initial&nbsp;infrastructure&nbsp;in conjunction with&nbsp;our partners.&nbsp;We&nbsp;also found other domains registered,&nbsp;likely by&nbsp;this&nbsp;threat&nbsp;actor&nbsp;given&nbsp;the use of&nbsp;similar procedures, that&nbsp;indicate&nbsp;a broader infrastructure that may be used&nbsp;or have been used&nbsp;in&nbsp;this and/or&nbsp;other&nbsp;phishing campaigns. We recommend blocking these domains/URLs now.&nbsp;&nbsp;
Below please find the updated&nbsp;IOCs:&nbsp;
Sender&nbsp;Emails:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">All emails are formatted as&nbsp;support@lastpass.[SERIES OF TWO TO FIVE RANDOM CHARACTERS]&nbsp;</li>
</ul>
URLs:&nbsp;
<ol>
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">systems-resources.s3.eu-west-3.amazonaws[.]com/sSvLaIvIEm5iMal&nbsp;</li>
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">security-lastpass.com&nbsp;</li>
</ol>
Associated IPs:&nbsp;&nbsp;
<ul class="ul3" style="color: #000000; list-style-type: square;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">172.67.157[.]54&nbsp;</li>
</ul>
<ul class="ul3" style="color: #000000; list-style-type: square;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">104.21.73[.]30&nbsp;</li>
</ul>
<ul class="ul3" style="color: #000000; list-style-type: square;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">109.205.213[.]50&nbsp;</li>
</ul>
Note: This IP is also associated with the following&nbsp;brand impersonation sites that may be used for illicit purposes:&nbsp;&nbsp;
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Emergency-access-lastpass[.]com&nbsp;</li>
</ul>
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Settings-lastpass[.]com&nbsp;</li>
</ul>
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Setting-lastpass[.]com&nbsp;</li>
</ul>
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Backup-lastpass[.]com&nbsp;</li>
</ul>
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Lastpass-backups[.]com&nbsp;</li>
</ul>
Subject Lines:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">LastPass Server Maintenance: Backup Recommended&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">LastPass Maintenance Scheduled: Here's What You Need to Do&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Critical: Please Backup Your LastPass Vault Before Maintenance&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">LastPass Infrastructure Update: Secure Your Vault Now&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">LastPass Maintenance: Secure Your Data Today&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Important: LastPass Maintenance &amp; Your Vault Security&nbsp;</li>
</ul>
While this is always a best practice,&nbsp;we recommend you&nbsp;confirm any email claiming to be from LastPass&nbsp;are&nbsp;coming from legitimate LastPass email domains&nbsp;as this campaign is ongoing. The domains are listed&nbsp;below&nbsp;and more information can be found here: <a href="https://support.lastpass.com/s/document-item?language=en_US&amp;bundleId=lastpass&amp;topicId=LastPass/phishing_report.html&amp;_LANG=enus">Report a phishing email to LastPass</a>&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">@lastpass.com&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">@sendgrid.com&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">@m.lastpass.com&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">@t.lastpass.com@ar.lastpass.com&nbsp;</li>
</ul>
Again, if you are ever unsure whether a LastPass branded email is legitimate,&nbsp;submit&nbsp;it to&nbsp;<a href="mailto:abuse@lastpass.com">abuse@lastpass.com</a>.&nbsp;
Original Post:&nbsp;
LastPass&nbsp;Threat Intelligence, Mitigation, and Escalation (TIME)&nbsp;would like to alert our customers&nbsp;to&nbsp;an&nbsp;active&nbsp;phishing campaign that&nbsp;began on or around January 19, 2026. These&nbsp;phishing emails are&nbsp;being sent&nbsp;from&nbsp;several&nbsp;email addresses&nbsp;with&nbsp;various&nbsp;subject lines&nbsp;claiming&nbsp;that&nbsp;LastPass is about&nbsp;to&nbsp;conduct maintenance and urging users to&nbsp;backup&nbsp;their vaults&nbsp;in the next 24 hours. The known list of email addresses&nbsp;and subject lines can be found below.&nbsp;&nbsp;&nbsp;
Please be advised&nbsp;that&nbsp;LastPass&nbsp;is&nbsp;NOT&nbsp;asking customers to&nbsp;backup&nbsp;their vaults in the next 24 hours; rather,&nbsp;this is an attempt on the part of&nbsp;a&nbsp;malicious actor to generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails.&nbsp;&nbsp;
The below image displays the body of&nbsp;an example&nbsp;email&nbsp;we have&nbsp;observed&nbsp;with&nbsp;a&nbsp;link purporting to take potential victims to a&nbsp;site that will&nbsp;supposedly allow&nbsp;recipients to create backups of their vault. Instead,&nbsp;this link&nbsp;will&nbsp;actually&nbsp;direct&nbsp;victims to a phishing site hosted at&nbsp;&ldquo;group-content-gen2.s3.eu-west-3.amazonaws[.]com/5yaVgx51ZzGf&rdquo;&nbsp;which then redirects to &ldquo;mail-lastpass[.]com.&rdquo;&nbsp;The timing of the campaign, which fell&nbsp;over a holiday weekend in the United States, is a common tactic among threat actors&nbsp;seeking&nbsp;to&nbsp;take advantage of reduced staffing under the assumption it will&nbsp;postpone detection and draw out response time.&nbsp;&nbsp;
Body of Current Phishing Email as of January 20, 2026
<img src="https://www.lastpass.com/-/media/d5b188257135407989134d0c48c84c7e.png" >
Please remember that no one at LastPass will&nbsp;ever ask for your master password.&nbsp;Rest assured,&nbsp;we are&nbsp;working&nbsp;with our third-party partners&nbsp;to have this domain taken down&nbsp;as soon as possible.&nbsp;In the meantime,&nbsp;please&nbsp;take the&nbsp;appropriate precautions&nbsp;and,&nbsp;as always, if you&nbsp;are ever unsure whether&nbsp;a&nbsp;LastPass branded&nbsp;email is&nbsp;legitimate,&nbsp; submit&nbsp;it to&nbsp;<a href="mailto:abuse@lastpass.com">abuse@lastpass.com</a>.&nbsp;We would like to thank our customers who have already&nbsp;submitted&nbsp;this email for their vigilance and&nbsp;commitment to keeping our community secure.&nbsp;&nbsp;
Malicious URLs and associated IPs:&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">&ldquo;group-content-gen2.s3.eu-west-3.amazonaws[.]com/5yaVgx51ZzGf&rdquo;&nbsp;</li>
</ul>
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li7" style="color: #211f1f; margin: 0px;">Serving IP address at time of publication:&nbsp;52.95.155[.]90&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">&ldquo;mail-lastpass[.]com&rdquo;&nbsp;</li>
</ul>
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li7" style="color: #211f1f; margin: 0px;">Associated&nbsp;IP addresses&nbsp;at time of publication:&nbsp;&nbsp;</li>
</ul>
<ul class="ul3" style="color: #000000; list-style-type: square;">
 <li class="li7" style="color: #211f1f; margin: 0px;">104.21.86[.]78&nbsp;</li>
</ul>
<ul class="ul3" style="color: #000000; list-style-type: square;">
 <li class="li7" style="color: #211f1f; margin: 0px;">172.67.216[.]232&nbsp;</li>
</ul>
<ul class="ul3" style="color: #000000; list-style-type: square;">
 <li class="li7" style="color: #211f1f; margin: 0px;">188.114.97[.]3 &nbsp;</li>
</ul>
Header information:&nbsp;
From:&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">support@sr22vegas[.]com&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">support@lastpass[.]server8&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">support@lastpass[.]server7&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">support@lastpass[.]server3&nbsp;</li>
</ul>
Associated&nbsp;IPs:&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">192.168.16[.]19&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">172.23.182.202&nbsp;</li>
</ul>
Subjects:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">LastPass Infrastructure Update: Secure Your Vault Now&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Your Data, Your Protection: Create a Backup Before Maintenance&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Don't&nbsp;Miss Out: Backup Your Vault Before Maintenance&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Important: LastPass Maintenance &amp; Your Vault Security&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li8" style="color: rgba(0, 0, 0, 0.85); background-color: #ffffff; margin: 0px;">Protect Your Passwords: Backup Your Vault (24-Hour Window)&nbsp;</li>
</ul>

January 2026 Phishing Campaign Targeting LastPass Customers [UPDATE] 

Another wave of phishing emails using similar tactics has been sent from the same threat actors on January 19. 

January 2026 Phishing Campaign Targeting LastPass Customers [UPDATE]

LastPass Threat Intelligence, Mitigation, and Escalation (TIME) team would like to alert our customers to an active phishing campaign that began on or around January 19, 2026. These phishing emails are being sent from several email addresses with various subject lines claiming that LastPass is about to conduct maintenance and urging users to backup their vaults in the next 24 hours. The known list of email addresses and subject lines can be found below.
Please be advised that LastPass is NOT asking customers to backup their vaults in the next 24 hours; rather, this is an attempt on the part of a malicious actor to generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails.
The below image displays the body of an example email we have observed with a link purporting to take potential victims to a site that will supposedly allow recipients to create backups of their vault. Instead, this link will actually direct victims to a phishing site hosted at &ldquo;group-content-gen2.s3.eu-west-3.amazonaws[.]com/5yaVgx51ZzGf&rdquo; which then redirects to &ldquo;mail-lastpass[.]com.&rdquo; The timing of the campaign, which fell over a holiday weekend in the United States, is a common tactic among threat actors seeking to take advantage of reduced staffing under the assumption it will postpone detection and draw out response time.

Body of Current Phishing Email as of January 20, 2026
<img src="https://www.lastpass.com/-/media/4850cdc5225c44ab8a5b8cd1afc79962.png" >
Please remember that no one at LastPass will ever ask for your master password. Rest assured, we are working with our third-party partners to have this domain taken down as soon as possible. In the meantime, please take the appropriate precautions and, as always, if you are ever unsure whether a LastPass branded email is legitimate, submit it to <a href="mailto:">abuse@lastpass.com</a>. We would like to thank our customers who have already submitted this email for their vigilance and commitment to keeping our community secure. 
Malicious URLs and associated IPs:
<ul>
 <li>&ldquo;group-content-gen2.s3.eu-west-3.amazonaws[.]com/5yaVgx51ZzGf&rdquo; 
 <ul>
 <li>Serving IP address at time of publication: 52.95.155[.]90 </li>
 </ul>
 </li>
 <li>&ldquo;mail-lastpass[.]com&rdquo; 
 <ul>
 <li>Associated IP addresses at time of publication: 
 <ul>
 <li>104.21.86[.]78</li>
 <li>172.67.216[.]232</li>
 <li>188.114.97[.]3</li>
 </ul>
 </li>
 </ul>
 </li>
</ul>
Header information:
From:
<ul>
 <li>support@sr22vegas[.]com</li>
 <li>support@lastpass[.]server8</li>
 <li>support@lastpass[.]server7</li>
 <li>support@lastpass[.]server3</li>
</ul>
Associated IPs:
<ul>
 <li>192.168.16[.]19</li>
 <li>172.23.182.202</li>
</ul>
Subjects:
<ul>
 <li>LastPass Infrastructure Update: Secure Your Vault Now</li>
 <li>Your Data, Your Protection: Create a Backup Before Maintenance</li>
 <li>Don't Miss Out: Backup Your Vault Before Maintenance</li>
 <li>Important: LastPass Maintenance &amp; Your Vault Security</li>
 <li>Protect Your Passwords: Backup Your Vault (24-Hour Window)</li>
</ul>

New Phishing Scam Targeting LastPass Users - The LastPass Blog

LastPass warns customers of a new phishing campaign urging fake vault backups. Learn how the scam works and how to protect your account.

New Phishing Campaign Targeting LastPass Customers

Strengthening Cyber Resilience Through Partnership: Insights from Australia and New Zealand

LastPass Senior Threat Intelligence Analyst Mike Kosak reflects on his recent travel to Australia and New Zealand to meet with customers and Australian and New Zealand government representatives. One of the common themes that arose consistently across my conversations was the importance of partnerships within cybersecurity. 

Blog

Blog

Recent

News & Insights

Cybersecurity

Product Tutorials

Threat Intel

Product Updates

Tips And Tricks

Subscribe & Save 20% off Premium or Families plans

The Phish Bowl: AI, Identity, and Emerging Threats — Webinar recap & resource guide

LastPass alerts customers to active phishing campaign using lookalike domains; no impact to LastPass systems

Klue Supply Chain Incident & LastPass Response

“Well, We Had a Good Run”: Thinking About Cyber Threats in the Age of AI, Part 2: Threats TO AI

“Well, We Had a Good Run”: Thinking About Cyber Threats in the Age of AI, Part 1: Threats FROM AI

LastPass Alerts Customers of Fake Email Chains Used in New Phishing Campaign; No Impact to LastPass Systems

Why Digital Squatting Still Works in 2026—And Why Defense Is So Hard

January 2026 Phishing Campaign Targeting LastPass Customers [FEBRUARY UPDATE]

The Phish Bowl Explores How Identity is Under Attack, Scattered LAPSUS$ Hunters, and Cybercrime Trends

January 2026 Phishing Campaign Targeting LastPass Customers [UPDATE]

New Phishing Campaign Targeting LastPass Customers

Strengthening Cyber Resilience Through Partnership: Insights from Australia and New Zealand