I write this from direct experience with password management and hardening. Phishing targets LastPass users. The attacks aim to steal your master password. I will walk through how to spot those attacks and what to change right away. No fluff. Clear steps you can follow in an hour.
Recognising Phishing Threats
Types of Phishing Attacks
- Credential harvesting pages. An attacker sends an email with a link that looks like LastPass. The link leads to a page that asks for your master password. That is the main trick in recent campaigns. See a recent example here.
- Malicious attachments or installers. Emails telling you to download a “security update” or a patched desktop app can contain malware that records keystrokes or grabs vault data.
- Voice and SMS social engineering. Attackers call or text, push urgency, and try to get you to click or read a code aloud. The call amps up pressure so you act without checking links.
Characteristics of Phishing Emails
- Wrong sender domain. The display name might say “LastPass”, but the sending address will be odd. Check the full email address.
- Urgent, alarming language that forces action. Typical subject lines in the campaign I’m referring to include “Legacy Request Opened (URGENT IF YOU ARE NOT DECEASED)”. See reporting on that campaign here.
- Links that do not match the domain. Hover to view the actual URL before clicking. Shortened or obfuscated links are a red flag.
- Requests for the master password, one-time codes, or an exported vault. LastPass will never ask you to send a master password.
Importance of Awareness
Phishing is a social attack. Technical controls help, but they do not fix a clicked link or a typed password on a fake page. Train your instinct for suspicious phrasing and mismatched headers. Run a quick check every time you get a LastPass-looking message:
- Check the sender address.
- Hover links, do not click.
- If the email references an action you did not perform, open your LastPass vault in a new browser window and check notifications there, not via the email link.
If an email looks off, report it to LastPass using their phishing report process so they can act on the sender and domain.
Implementing Security Measures
Multi-Factor Authentication
Turn on multi-factor authentication for LastPass and pick a phishing-resistant option. Use FIDO2 security keys (hardware tokens) or an authenticator app that supports push or TOTP. Do not rely solely on SMS codes; those can be intercepted or coerced. In LastPass, add at least two MFA methods so you have a fallback if a key or device fails. Test each method after setup: log out and log back in, then confirm the second factor prompts as expected.
Creating Strong Passwords
Your master password is the single most sensitive secret. Make it long and unique. I use a passphrase of 16–24 characters with mixed words and punctuation. Do not reuse it elsewhere. If you prefer entropy, use a 20+ character random string generated by a reputable password generator. Store recovery hints offline, not in the vault. Enable the extra account secret key if your LastPass plan supports it; that adds another secret the phishers cannot request via email.
Regular Security Audits
Run periodic checks of your LastPass vault. Look for:
- Unfamiliar or duplicate logins.
- Recently added vault items you did not create.
- Items with weak or breached passwords reported by LastPass auditing tools. Replace weak entries with new, unique passwords.
Schedule an audit every quarter and after any suspected incident. Keep a local, encrypted backup of critical credentials. Rotate the highest-value credentials first: email, bank, crypto accounts, and your LastPass master password itself if you suspect a compromise.
Reporting Suspicious Activity
If you find a suspicious email or a fake login page, do three things:
- Do not enter any credentials. Close the page.
- Forward the original email to LastPass support via their phishing report channel so they can investigate. Use the support link I referenced earlier.
- Change your master password from a trusted device and sign out all sessions in LastPass if you suspect exposure. Revoke any unknown sessions and remove devices you no longer use.
Concrete steps to run now
- Enable a FIDO2 key in LastPass and register a second MFA method.
- Change your master password to a long passphrase.
- Run a vault audit and fix any weak or reused entries.
- Add the account secret key if available.
- Report any odd LastPass emails to LastPass support immediately.
I keep this tight because speed matters. Phishing relies on fast reactions and split-second panic. Slow down, check the sender, open LastPass directly, and use phishing-resistant multi-factor authentication. That combination will reduce the chance of losing your vault to a scam.
Links: Computerworld article on the campaign, LastPass phishing report and guidance
