LastPass Warns of Phishing Campaign Targeting Its Customers - TechRepublic

"Cybercriminals have launched a sophisticated phishing campaign targeting LastPass customers with urgent "maintenance" alerts designed to steal master passwords within hours. Security experts are calling this latest attack "alarmingly effective" because it exploits users' trust in legitimate security notifications during a strategically chosen holiday weekend. The scheme revolves around fake emails claiming users must backup their password vaults within 24 hours to prevent data loss."

"But here's the twist: clicking those "backup" links doesn't create any backup-it hands over the keys to everything users have tried to protect. LastPass detected the campaign starting Jan. 19, with attackers sending messages from addresses like '[email protected]' and '[email protected] ' with subject lines including "LastPass Infrastructure Update: Secure Your Vault Now" and "Protect Your Passwords: Backup Your Vault (24-Hour Window).""

"The timing wasn't random-threat actors deliberately launched during the U.S. holiday weekend, banking on reduced security staffing to maximize their window before detection and takedown. Cybercriminals have perfected the art of timing, and this campaign proves it. The phishing messages craft a believable story about upcoming infrastructure maintenance requiring immediate local backups to prevent data loss. The fake emails arrive designed to appear as genuine LastPass communications, explaining that users need to back up their vaults locally due to system updates."

Cybercriminals launched a sophisticated phishing campaign targeting LastPass customers with urgent maintenance alerts meant to steal master passwords within hours. The emails urged users to create local backups within 24 hours, but the backup links led to phishing sites that captured master passwords. LastPass detected the campaign on Jan. 19, with attackers using spoofed addresses and convincing subject lines like "LastPass Infrastructure Update: Secure Your Vault Now." Attackers timed the campaign for a U.S. holiday weekend to exploit reduced security staffing and delay detection. The messages included believable maintenance language to prompt immediate action and redirected victims to malicious sites.

Read at TechRepublic