Quick Summary
LastPass has alerted customers about a phishing campaign that started around January 19, urging users to back up their vaults. The emails, claiming to be from LastPass, create a sense of urgency and request action within 24 hours. Clicking the provided link redirects users to a phishing site designed to steal their master password, potentially compromising sensitive information stored in their vaults.
The Securityish Brief
LastPass has issued a warning regarding a phishing campaign that began on January 19, targeting its customers with emails about supposed maintenance. These emails falsely claim that users must back up their vaults within 24 hours, using urgency as a tactic to manipulate recipients. LastPass clarified that they are not requesting any such backups and emphasized that no one from the company will ever ask for users’ master passwords.
The phishing emails were sent from various addresses and featured multiple subject lines, all designed to mislead users. Clicking on the link in these emails leads to a phishing site that aims to capture users’ master passwords, which could expose their sensitive information, including usernames, passwords, and credit card details.
This is not the first time LastPass has faced phishing attempts; just two months prior, they alerted users about another campaign that asked them to confirm they were alive. The timing of these scams often coincides with holidays, such as the Martin Luther King Jr. holiday weekend, when fewer employees are available to report suspicious activities.
Understanding the Risks
Phishing attacks like this one highlight the ongoing risks associated with password managers, which store critical information protected by a single master password. As these tools become more prevalent, they attract malicious actors looking to exploit vulnerabilities. Users must remain vigilant against such tactics, which often involve creating a false sense of urgency.
LastPass is actively working with third-party partners to take down the malicious domains involved in this scam. They have also provided a list of the phishing URLs, IP addresses, and email addresses used in this campaign to assist users in identifying and avoiding these threats.
For users of LastPass and similar services, it is crucial to be cautious with any unsolicited emails requesting sensitive actions. Always verify the authenticity of such communications directly with the service provider.
Key Takeaways
- Do not click on links in unsolicited emails claiming to be from LastPass or similar services.
- Verify any requests for action by logging into your account directly through the official website.
- Enable two-factor authentication on your LastPass account for added security.
- Regularly update your master password and ensure it is strong and unique.
- Monitor your accounts for any suspicious activity and report it immediately.
Key Terms & Concepts
- Phishing: In this article, phishing refers to fraudulent attempts to obtain sensitive information by disguising as a trustworthy entity in electronic communications.
- LastPass: LastPass is a password manager that stores users’ sensitive information, including passwords and credit card details, protected by a master password.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2026/01/21/lastpass_backup_phishing_campaign/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
