Fake Security Alerts Target LastPass and Bitwarden Users
Summary
Fake security emails targeting LastPass and Bitwarden users lead to counterfeit DocuSign pages. LastPass says its systems were not compromised; the malicious site prompted downloads and was later taken offline.
Key points
- Phishing emails impersonate LastPass security notices and claim there are service policy changes.
- Messages from [email protected] direct recipients to a fake DocuSign page at lastpasscompliance[.]com.
- Similar emails targeting Bitwarden users come from [email protected] and redirect to bitwardencompliance[.]com.
- LastPass says the emails did not originate from its infrastructure and its systems were not compromised.
- The fake site prompted users to download a file purportedly for Windows and macOS; its purpose was unclear, and the site was offline at the time of reporting.
- LastPass advises users to report suspicious messages and to change their master password from a trusted device if they entered credentials.
Article Details
- Event Type
- Phishing campaign using fake security notices and counterfeit DocuSign pages to target LastPass and Bitwarden users.
- Impact
- The campaign directs users to phishing sites and prompts them to download a file presented as supporting Windows and macOS. LastPass could not confirm the campaign’s goal. Users who entered credentials are advised to change their master passwords and review their vaults; no compromise of LastPass systems was reported.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bitwardencompliance[.]com | Phishing destination used by emails targeting Bitwarden users. |
| DOMAIN | lastpasscompliance[.]com | Malicious phishing site impersonating DocuSign and linked from emails targeting LastPass users; reported offline at the time of writing. |
hello@bitwardennewsletter[.]com | Sender address used for similar phishing emails targeting Bitwarden users. | |
hello@lastpassnewsletter[.]com | Sender address used for phishing emails impersonating LastPass security notices. |
MITRE ATT&CK
Vendors
Products
Bitwarden#LastPassDocuSignLastPass is warning users about a phishing campaign that uses fake security notices and a counterfeit DocuSign page to lure victims to malicious sites.LastPassLastPass is warning users about a phishing campaign that uses fake security notices and a counterfeit DocuSign page to lure victims to malicious sites.