Fake password-manager alerts could put your vault at risk

You unfastened your inbox and spot a connection astir updated information policies. Nothing astir it screams scam. The email looks polished, the wording sounds authoritative and the fastener promises a speedy mode to reappraisal the changes. That is precisely what makes it dangerous.

LastPass is informing users astir a recently identified phishing run that uses lookalike domains and a fake DocuSign leafage to lure radical into downloading suspicious software.

The bully quality is that LastPass says its systems were not affected. The atrocious quality is that scammers are counting connected you to spot the logo, place the web code and click earlier taking a person look. Here is what to ticker for earlier 1 routine-looking email puts your full password vault astatine risk.

Free unrecorded CyberGuy class: Sick of Spam? Join america July 22

Join america TODAY, Wednesday, July 22, astatine 1 PM ET for a escaped CyberGuy Live people that volition assistance you chopped down connected robocalls, spam texts, junk email and different unwanted messages. Kurt "CyberGuy" Knutsson volition locomotion you measurement by measurement done elemental ways to filter spam, cleanable up your inbox and admit the messages that could enactment your idiosyncratic accusation astatine risk. No method acquisition is needed. You’ll besides person our spam-stopping checklist, and each registrant volition get a nexus to the people signaling afterward.

Reserve your escaped spot contiguous astatine CyberGuyLive.com.

FBI HELPS TAKE DOWN AI PHISHING RING

Scammers are impersonating LastPass with fake argumentation emails that pb users to a fraudulent DocuSign leafage and suspicious bundle download. (Kurt "CyberGuy" Knutsson)

LastPass phishing scam starts with a regular argumentation email

The phishing email comes from [email protected]. Its known taxable enactment reads, "Action Required: Review Updated LastPass Security Policies." Inside, the connection claims LastPass has made work argumentation changes. It mentions enhanced SaaS monitoring. It besides claims administrators tin reset maestro passwords and that the admin console has improved.

Those details marque the email dependable similar a existent institution notice. However, the sending domain belongs to the attackers. LastPass says lastpassnewsletter[.]com has nary affiliation with the company. The email includes a Review & Access Terms button. That fastener creates the adjacent furniture of the trap.

Fake LastPass leafage sends you to a DocuSign lookalike

Clicking the fastener sends you to lastpasscompliance[.]com. The landing leafage copies the look of DocuSign and claims a papers is acceptable for review. That prime makes consciousness from a scammer's perspective. Many radical person physics signature requests astatine enactment oregon portion handling idiosyncratic paperwork. A acquainted layout tin little your defender earlier you inspect the web address.

We person seen the aforesaid spot instrumentality successful different fake DocuSign email scams. The marque sanction gives the petition a consciousness of legitimacy, adjacent erstwhile the sender and domain bash not match. LastPass says Microsoft Defender for Office 365 and Cloudflare classified the phishing tract arsenic malicious. The leafage besides prompted visitors to download bundle that claimed to enactment connected Windows and macOS.

LastPass was inactive investigating the download erstwhile it published its warning. Therefore, you should dainty the record arsenic unsafe and debar opening it. The tract besides displayed a unrecorded enactment chat box, though it was unclear whether the chat worked. The malicious leafage had gone offline by the clip the run was reported. However, attackers tin rapidly regenerate blocked domains with caller ones.

Similar Bitwarden emails widen the warning

LastPass users are not the lone targets. Bitwarden customers person received akin messages from [email protected]. Those emails directed recipients to bitwardencompliance[.]com. The matching format suggests attackers whitethorn beryllium reusing the aforesaid run operation crossed password manager brands.

That matters due to the fact that password manager customers contiguous an charismatic target. One stolen maestro password could enactment galore saved accounts astatine risk. Multi-factor authentication whitethorn inactive artifact access, depending connected your information settings.

A password manager remains invaluable protection. In fact, autofill tin assistance exposure a fake website due to the fact that the manager should admit the morganatic domain. You tin comparison existent options successful our usher to the champion password managers for 2026 astatine cyberguy.com

LastPass users person faced respective phishing lures successful 2026

This run follows different LastPass-themed phishing attempts from earlier this year. In January, fake messages warned that users had lone 24 hours to backmost up their vaults earlier maintenance. Then, a March run utilized fabricated email threads astir unauthorized relationship access.

Both approaches relied connected urgency to propulsion radical into acting earlier they verified the message. The caller compliance announcement uses a calmer approach. It looks similar paperwork alternatively than a crisis. That whitethorn marque it particularly effectual due to the fact that argumentation updates consciousness mean and boring.

REDHOOK ANDROID MALWARE CAN QUIETLY HIJACK YOUR PHONE

Ways to enactment harmless from the LastPass phishing scam

The fraudulent leafage impersonates DocuSign and prompts visitors to download suspicious bundle for Windows oregon macOS. (LastPass)

A fewer cautious steps tin support 1 convincing email from turning into a overmuch larger problem.

1) Do not click the argumentation reappraisal button

Delete the connection oregon study it arsenic phishing. Do not reply. Avoid opening its links oregon downloading the record it offers.

2) Open LastPass connected your own

Use the authoritative LastPass app oregon benignant lastpass.com into your browser. Check for relationship notices aft you motion successful done the trusted route.

3) Read the afloat domain earlier entering anything

Lookalike domains often adhd a trusted marque sanction to words specified arsenic "newsletter" oregon "compliance." Check the website code earlier the archetypal slash. A morganatic LastPass code should extremity successful lastpass.com, specified arsenic support.lastpass.com, alternatively than simply containing the connection "LastPass."

4) Pay attraction erstwhile autofill stays silent

A password manager whitethorn garbage to capable your credentials connected a fake domain. Treat that arsenic a warning. Do not transcript and paste the password to get astir it. Instead, adjacent the leafage and entree your relationship done the authoritative app oregon website.

5) Change your maestro password if you entered it

Use a trusted instrumentality and spell straight to LastPass. Change the maestro password immediately. Then reappraisal your vault for unexpected activity, arsenic LastPass recommends. Next, alteration passwords for delicate accounts stored successful the vault if you spot signs of access. Start with email, fiscal accounts, unreality retention and societal media. Use a antithetic password for each account.

AMAZON RECALL TEXT SCAM COMES WITH RED FLAGS

The scam relies connected polished information notices, acquainted branding and misleading web addresses to little users’ defenses. (Kurt "CyberGuy" Knutsson)

6) Treat the download arsenic dangerous

Do not unfastened bundle offered by a information announcement you reached done email. If you already opened the file, disconnect the affected instrumentality from the internet. Then usage beardown antivirus bundle to inspect it. Our existent champion antivirus extortion usher astatine cyberguy.com tin assistance you comparison tools that artifact malicious websites and unsafe downloads. It besides covers extortion against malware. You tin besides travel these steps aft you clicked a suspicious email and entered information.

7) Turn connected multi-factor authentication

Enable multi-factor authentication for your password manager and different important accounts. An authenticator app oregon information cardinal tin adhd a obstruction if idiosyncratic steals your password. However, ne'er o.k. a login petition you did not initiate. A 2nd information measurement lone helps erstwhile you dainty unexpected prompts arsenic a warning.

8) Reduce the idiosyncratic accusation scammers tin find

Scammers often usage accusation from information broker sites to marque phishing emails consciousness much personal. That could see your telephone number, location address, relatives oregon past employers. A information removal work tin assistance find and region immoderate of that accusation from people-search websites. It volition not unafraid a compromised password manager, but it whitethorn springiness scammers less details to usage successful aboriginal attacks. Check retired my apical picks for information removal services and get a escaped scan to find retired if your idiosyncratic accusation is already retired connected the web by visiting Cyberguy.com

9) Report suspicious LastPass messages

Forward questionable LastPass-branded emails to [email protected]. LastPass says nary 1 from the institution volition ever inquire for your maestro password.

Kurt's cardinal takeaways

What makes this scam unsafe is however mean the email looks. Most radical expect password manager alerts to dependable urgent. This 1 arrives dressed up arsenic a boring argumentation update, which whitethorn marque you little apt to question it. The biggest reddish emblem is the web address. A institution sanction wrong a domain does not mean the institution owns it. Before entering a maestro password oregon downloading anything, adjacent the email and unfastened the password manager directly. Your maestro password protects everything stored successful your vault. Treat immoderate petition for it similar idiosyncratic asking for the keys to your house.

Have you ever received a information email that looked truthful existent you astir clicked? What made you halt and instrumentality a person look? Let america cognize by penning to america astatine Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

• Get my champion tech tips, urgent information alerts and exclusive deals delivered consecutive to your inbox.
• For simple, real-world ways to spot scams aboriginal and enactment protected, sojourn CyberGuy.com - trusted by millions who ticker CyberGuy connected TV daily.
• Plus, you'll get instant entree to my Ultimate Scam Survival Guide escaped erstwhile you join.

Copyright 2026 CyberGuy.com. All rights reserved.