LastPass has issued an urgent warning regarding a new, highly coordinated phishing campaign as of March 4, 2026. This is the second major campaign targeting the service this year, following a similar wave in January.
Campaign Details
- The Lure: Fraudulent emails alert users to “unauthorized access” or “master password changes.”
- Social Engineering: Attackers use spoofed display names to hide their real email addresses, particularly targeting mobile users who often cannot see the full sender address.
- The Goal: To trick victims into clicking links that lead to a fake login page designed to harvest Master Passwords.
- Urgency Tactics: Messages urge immediate action, such as revoking devices or locking vaults, to bypass the user’s critical thinking.
Earlier 2026 Campaign (January)
A preceding campaign in January 2026 used different tactics:
- Lure: Fake “scheduled maintenance” or “infrastructure updates.”
- Instruction: Users were told to create a “vault backup” within a 24-hour window to avoid service disruption.
- Timing: This campaign was launched over the Martin Luther King Jr. holiday weekend in the U.S. to exploit reduced security staffing.
Official Safety Guidelines
- Master Password: LastPass will NEVER ask for your master password via email, phone, or text.
- Direct Access: Always log in by manually typing
lastpass.com into your browser or using the official mobile app/browser extension rather than clicking email links.
- Reporting: Forward any suspicious LastPass-branded emails to the official abuse reporting address: [email protected].
- Verify Senders: Check the actual sender domain (e.g., fraudulent domains like
sr22vegas.com or mail-lastpass.com have been used previously).
What to do if you are compromised
If you have already clicked a link or entered your credentials on a suspicious site:
- Change your Master Password immediately on the official LastPass website.
- Enable Multi-Factor Authentication (MFA) if you haven’t already.
- Review vault activity for any unauthorized changes.
