Fake password-manager alerts could put your vault at risk
LastPass Warns Users About Phishing Campaign Disguised as Routine Policy Update
The password manager LastPass is alerting customers to a new phishing scheme designed to look like an ordinary corporate notice, exploiting the bland familiarity of policy updates to trick people into downloading harmful software.
The fraudulent emails appear to come from the address hello@lastpassnewsletter.com and carry the subject line "Action Required: Review Updated LastPass Security Policies." The messages reference changes to service policies, enhanced SaaS monitoring, administrator password reset capabilities, and improvements to the admin console. A button labeled "Review & Access Terms" leads the recipient to the next stage of the scam.
According to LastPass, the domain lastpassnewsletter.com has no connection to the company. Clicking the button directs users to lastpasscompliance.com, a page that mimics the appearance of DocuSign and claims a document is awaiting review. The fake DocuSign layout is a deliberate choice by the attackers, who are counting on the fact that many people regularly receive and sign electronic documents, making the request feel unremarkable.
Microsoft Defender for Office 365 and Cloudflare both identified the phishing site as malicious. The page prompted visitors to download software claiming compatibility with Windows and macOS. LastPass said it was still investigating the nature of the file when it published its warning and advised users to treat it as dangerous. The malicious page had been taken offline by the time the campaign was publicly reported, but attackers are known to quickly stand up new domains once one is blocked.
The campaign is not limited to LastPass users. Bitwarden customers have received similar messages from hello@bitwardennewsletter.com directing them to bitwardencompliance.com, suggesting the same operators may be targeting password manager customers across multiple brands. Because a single stolen master password can expose every credential stored in a user's vault, password manager customers represent a particularly high-value target.
This is the third LastPass-themed phishing campaign reported this year. In January, fake messages warned users they had 24 hours to back up their vaults before scheduled maintenance. A March campaign used fabricated email threads claiming unauthorized access to user accounts. Both earlier efforts relied on urgency to push recipients into acting before verifying. The compliance-themed approach is more understated, and that may be what makes it effective.
LastPass emphasized that its own systems were not compromised in the campaign. The threat comes entirely from users being deceived into interacting with lookalike domains and downloading unverified software.
Recognizing the warning signs
Lookalike domains typically pair a trusted brand name with generic words like "newsletter" or "compliance." A genuine LastPass URL will end in lastpass.com, such as support.lastpass.com, rather than simply containing the word "LastPass" within a longer address. Before clicking any link or downloading any file, users should verify the domain carefully.
Password managers can also serve as a built-in safeguard. Because autofill is tied to recognized domains, a legitimate password manager may refuse to enter credentials on a fake site. Users who encounter that behavior should treat it as a warning, not an obstacle to work around by copying and pasting a password manually.
LastPass also noted that no one from the company will ever ask a user for their master password, a rule that applies to any password manager.
What to do if you receive the email
Delete the message or report it as phishing through your email client. Do not reply, click any links, or download any attachments. To check whether a real account notice exists, open the official LastPass application or type lastpass.com directly into a browser rather than following links from an email.
Suspicious LastPass-branded emails can be forwarded to abuse@lastpass.com.
If you may have interacted with the scam
Users who clicked the link, reached the fake site, or downloaded the offered file should access LastPass from a trusted device by navigating directly to the official site or app. Change the master password immediately and review the vault for any unexpected activity. If there are signs of unauthorized access, change the passwords for sensitive accounts stored in the vault, starting with email, financial accounts, cloud storage, and social media. Each account should have a unique password.
If the downloaded file was opened, disconnect the affected device from the internet and run a thorough scan using reputable antivirus software. Do not open any additional software offered through an email notice, regardless of how official it appears.
Enabling multi-factor authentication on the password manager and on other important accounts adds a critical layer of protection. Authenticator apps or hardware security keys are recommended over SMS-based verification. Users should never approve a login prompt they did not initiate, as multi-factor authentication only works when unexpected requests are treated as warnings.
The campaign illustrates how phishing tactics continue to evolve. Scammers have moved away from overtly urgent messages and are instead imitating the kind of routine administrative communication that most people barely think twice about. A polished layout, a familiar brand, and a boring subject line can be just as dangerous as an alarm bell, and often more so, because they invite no scrutiny at all.
A master password protects the keys to nearly every account a person relies on. Any email that asks for it, no matter how legitimate it appears, should be treated the same as a stranger asking for the keys to the front door.
