FAKE LASTPASS, BITWARDEN BREACH ALERTS LEAD TO PC HIJACKS

Summary from the TLDR InfoSec newsletter

Cybercriminals are conducting a phishing campaign targeting password manager users with fake breach notification emails that trick recipients into downloading malware disguised as "secure desktop versions" of LastPass and Bitwarden. The malicious downloads install Syncro MSP agent software configured to deploy ScreenConnect remote access tools, giving attackers full control over compromised systems while remaining hidden from users. Security professionals should educate users that legitimate password manager companies never request master passwords via email and that security incidents are always announced through official channels and verified company blogs.