LastPass is warning of a brand new phishing marketing campaign disguised as a upkeep notification from the service, asking customers to again up their vaults within the subsequent 24 hours.
The malicious emails embody a hyperlink that allegedly takes customers to a website the place they’ll create an encrypted backup, the place the attacker possible tries to hijack accounts or steal vault grasp passwords.
“Please be suggested that LastPass is NOT asking clients to again up their vaults within the subsequent 24 hours; fairly, that is an try on the a part of a malicious actor to generate urgency within the thoughts of the recipient, a typical tactic for social engineering and phishing emails,” LastPass warns.
The LastPass Menace Intelligence, Mitigation, and Escalation (TIME) group believes that the marketing campaign began on January 19 and noticed phishing messages delivered from e-mail addresses of the kind ‘assist@lastpass[.]server8’ and ‘assist@sr22vegas[.]com’ with the next topic traces:
- LastPass Infrastructure Replace: Safe Your Vault Now
- Your Knowledge, Your Safety: Create a Backup Earlier than Upkeep
- Do not Miss Out: Backup Your Vault Earlier than Upkeep
- Essential: LastPass Upkeep & Your Vault Safety
- Defend Your Passwords: Backup Your Vault (24-Hour Window)
Crafted to seem as real LastPass communications, the emails say that customers must again up their vaults regionally to safe their information as a result of an upcoming infrastructure upkeep.
“Whereas your information stays absolutely protected always, creating a neighborhood backup ensures you have got uninterrupted entry to your credentials throughout the upkeep window,” reads the phishing e-mail.
“Within the unlikely occasion of any unexpected technical difficulties or information discrepancies, having a current backup ensures your data stays safe and recoverable.”
Supply: LastPass
Customers who click on on the ‘Create Backup Now’ button embedded within the e-mail are redirected to a phishing website at ‘mail-lastpass[.]com,’ which seems to be offline on the time of writing.
LastPass feedback that the attackers selected to launch this marketing campaign throughout a vacation weekend in the US, to catch them understaffed and fewer ready for a immediate response.
The password administration firm reminds customers that it’s going to by no means ask customers for his or her grasp passwords, urging them to report such incidents to ‘abuse@lastpass.com.’
LastPass customers are ceaselessly focused by phishing campaigns that use numerous themes and lures to trick them into revealing their passwords.
In October 2025, a phishing marketing campaign used faux demise claims to set off a legacy inheritance course of.
Every week earlier than, one other marketing campaign used faux breach alerts to induce customers to obtain a safer desktop model of the shopper app.
It is finances season! Over 300 CISOs and safety leaders have shared how they’re planning, spending, and prioritizing for the 12 months forward. This report compiles their insights, permitting readers to benchmark methods, determine rising tendencies, and evaluate their priorities as they head into 2026.
Find out how high leaders are turning funding into measurable influence.
