LastPass has issued a warning about a phishing campaign using deceptive emails and fake websites to trick users into downloading harmful software, potentially compromising their password vaults.
LastPass is alerting users to a newly identified phishing campaign that employs lookalike domains and a counterfeit DocuSign page to deceive individuals into downloading malicious software. This warning comes as users may receive seemingly legitimate emails that appear to be from LastPass.
The phishing email typically originates from hello@lastpassnewsletter.com, with the subject line “Action Required: Review Updated LastPass Security Policies.” The content of the email claims that LastPass has made changes to its service policies, including enhanced monitoring and the ability for administrators to reset master passwords. These details are crafted to make the email sound credible, but the sending domain is not affiliated with LastPass.
According to LastPass, the domain lastpassnewsletter[.]com is controlled by the attackers. The email contains a button labeled “Review & Access Terms,” which, when clicked, redirects users to a fraudulent site, lastpasscompliance[.]com. This landing page mimics the appearance of DocuSign, suggesting that a document is ready for review. This tactic is particularly effective, as many users are accustomed to receiving electronic signature requests, making them less vigilant about verifying the web address.
LastPass has noted that both Microsoft Defender for Office 365 and Cloudflare have classified the phishing site as malicious. The fraudulent page prompts visitors to download software purportedly compatible with Windows and macOS. As of the warning’s publication, LastPass was still investigating the nature of the download, but users are advised to treat the file as dangerous and refrain from opening it.
Interestingly, LastPass users are not the only targets of this phishing scheme. Customers of Bitwarden have also reported receiving similar emails from hello@bitwardennewsletter.com, which direct them to bitwardencompliance[.]com. This suggests that attackers may be employing a consistent campaign structure across different password manager brands.
Password manager users are particularly appealing targets for scammers, as gaining access to a single master password can compromise numerous accounts. While multi-factor authentication can provide an additional layer of security, it may not be sufficient if the master password is stolen.
Despite the risks, password managers remain an essential tool for online security. Autofill features can help users identify fake websites, as legitimate password managers should recognize authentic domains. For those looking to compare current options, a guide to the best password managers for 2026 is available at cyberguy.com.
This latest phishing campaign follows earlier attempts targeting LastPass users. In January, fake emails warned recipients that they had only 24 hours to back up their vaults due to maintenance. A subsequent campaign in March used fabricated email threads claiming unauthorized account access. Both of these earlier tactics relied on urgency to prompt users into acting without verifying the messages. In contrast, the current compliance notice adopts a calmer approach, presenting itself as a routine policy update, which may make it even more effective.
To protect against falling victim to such scams, users should take several precautions. First, delete any suspicious messages or report them as phishing. It is crucial not to reply to these emails or click on any links they contain. Instead, users should access their LastPass accounts through the official app or by typing lastpass.com directly into their browser. Checking for account notices after logging in through a trusted route is essential.
Lookalike domains often incorporate trusted brand names with words like “newsletter” or “compliance.” Users should always verify the website address before the first slash; a legitimate LastPass address will end in lastpass.com, such as support.lastpass.com, rather than merely including the word “LastPass.”
If a password manager refuses to autofill credentials on a suspicious domain, users should treat this as a warning. Instead of copying and pasting passwords, it is advisable to close the page and access the account through the official app or website. If users suspect they may have been compromised, they should use a trusted device to change their master password immediately and review their vault for any unusual activity.
Additionally, users should avoid opening any software offered through security notices received via email. If a file has already been opened, disconnect the affected device from the internet and run a thorough scan using reputable antivirus software. For guidance on effective antivirus protection, users can refer to the current best antivirus protection guide at cyberguy.com.
Enabling multi-factor authentication for password managers and other critical accounts can add an extra layer of security. However, users should never approve login requests they did not initiate, as this step is only effective when unexpected prompts are treated as potential threats.
Scammers often leverage information from data broker sites to personalize phishing emails, making them appear more legitimate. Services that assist in data removal can help reduce the amount of personal information available to scammers, although they do not secure compromised password managers. For a free scan to check if personal information is publicly accessible, users can visit Cyberguy.com.
Lastly, LastPass encourages users to forward any questionable emails branded with their name to abuse@lastpass.com. The company emphasizes that it will never request a master password from users.
The deceptive nature of this phishing campaign highlights the importance of vigilance when it comes to email communications. The seemingly mundane appearance of the email can lead users to let their guard down. The most significant red flag is the web address; a company name in a domain does not guarantee ownership. Before entering a master password or downloading any files, users should close the email and access their password manager directly. Remember, your master password is the key to your digital vault, and any request for it should be treated with utmost caution.
For more information on cybersecurity and to stay updated on potential threats, visit Cyberguy.com.