This phishing campaign targets users of LastPass and Bitwarden by sending emails from addresses resembling official newsletters (e.g., [email protected] and [email protected]). The emails notify recipients of supposed security policy updates and direct them to malicious domains such as lastpasscompliance[.]com and bitwardencompliance[.]com, which impersonate the DocuSign service. The fake sites prompt users to download files purportedly supporting Windows and macOS. LastPass states that its infrastructure was not compromised and that these phishing emails are external attacks. The malicious domains have been flagged by security services and taken offline at the time of reporting.

Users who fall for the phishing emails and interact with the fraudulent websites risk credential theft, including their master passwords for password managers. This could lead to unauthorized access to their password vaults and sensitive data. The campaign exploits user trust in official communications and widely used services, potentially compromising user accounts if credentials are submitted.

LastPass has confirmed that its systems are not compromised and that the phishing emails are external. Users should be aware that LastPass will never request their master password via email. Users who receive suspicious communications should report them to [email protected]. Those who have entered credentials on phishing sites should immediately change their master passwords from a trusted device and review their vaults for suspicious activity. The malicious websites involved have been taken offline. No official patch or fix is applicable as this is a phishing campaign rather than a software vulnerability.