LastPass Warns of Phishing Emails Targeting Master Passwords
Summary
LastPass says an active phishing campaign, underway since about March 1, 2026, uses spoofed display names and fake security alerts to send users to a fraudulent SSO page that steals master passwords. The company is pursuing takedowns and urges caution.
Key points
- LastPass says the campaign began around March 1, 2026, and remains active.
- Attackers spoof LastPass display names and send fake email threads about account access, vault exports, recovery, or device registration.
- Links lead to a fraudulent SSO page at hxxps://verify-lastpass[.]com that collects credentials.
- The alerts may hide the sender’s actual address behind a familiar display name, especially in mobile email clients.
- LastPass says it will never ask users for their master password and is working with partners to take down phishing sites.
Article Details
- Event Type
- Credential-phishing campaign using spoofed LastPass security alerts
- Impact
- The campaign directs users to a fake SSO page to steal master passwords, potentially compromising their accounts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//verify-lastpass[.]com | Phishing URL identified as a fake SSO page used to collect users’ credentials. |