Hackers Mimic LastPass Support Email to Steal Vault Passwords
## Cybersecurity: Phishing Campaign Targeting LastPass Users
Cybersecurity: Phishing Campaign Targeting LastPass Users
A phishing campaign is actively targeting LastPass users by sending fraudulent support emails to obtain vault master passwords. Initiated around Tue, Mar 1, 2026, this operation employs social engineering tactics to deceive users into believing their accounts are compromised, encouraging them to provide their credentials.
The attackers use fabricated email chains to simulate unauthorized actions on the victims' LastPass accounts, including exporting vault data , initiating full account recovery, and registering new devices. This creates a false urgency, prompting users to click on links and act quickly.
The LastPass TIME team identified the campaign and issued a public advisory on Thu, Mar 3, 2026. While LastPass systems remain unaffected, the threat lies in users entering credentials on spoofed login pages. Collaboration with third-party partners aims to dismantle these malicious sites swiftly.
Victims are redirected through multiple links to a fraudulent login page at verify-lastpass[.]com , where credentials are collected. Attackers vary the domain URL slightly to evade basic URL-filtering tools.
A phishing campaign is actively targeting LastPass users by sending fraudulent support emails to obtain vault master passwords.
LastPass advises users to be cautious of unexpected emails about account activity. They emphasize that master passwords will not be requested via email. Suspicious emails should be reported to abuse@lastpass.com for investigation.
The campaign uses display name spoofing, where the visible sender name is altered, but the email originates from unrelated domains such as hancochem[.]at and salud5i[.]cl . This tactic is particularly effective on mobile devices where the sender's email address is not immediately visible.
Upon clicking embedded links, users encounter a fake LastPass single sign-on page designed to capture master passwords. Phishing pages are served from IP addresses like 172.67.200[.]82 and 104.21.21[.]204 . Users are advised to verify the sender's address and navigate directly to LastPass through a web browser.
Based on reporting by Cyber Security News.