PHISHING CAMPAIGN ZEROES IN ON LASTPASS CUSTOMERS

Summary from the TLDR InfoSec newsletter

An ongoing phishing campaign targeting LastPass customers began around January 19, using LLM-crafted emails with plausible subject lines urging users to "back up their vaults" before scheduled maintenance. The phishing emails direct victims to credential-harvesting sites designed to capture master passwords, potentially compromising entire password vaults. Organizations should alert users to verify email sender addresses, enable MFA on password managers, and report suspicious LastPass-branded emails.