{"id":"lastpass-fake-maintenance-phishing-jan-2026","category":"scam","status":"closed","title":"Fake LastPass maintenance emails targeted customers’ master passwords","tldr":"Fake LastPass emails demanded a vault backup within 24 hours and linked to pages targeting master passwords. Further waves followed takedowns, including on 20 February. Ignore the request, open LastPass directly and report suspicious emails to abuse@lastpass.com.","summary":"A phishing campaign targeting LastPass customers began around 19 January 2026. Emails impersonating the password manager claimed that maintenance required customers to back up their vaults within 24 hours. Their links led to fraudulent pages designed to collect login credentials, including master passwords, potentially putting passwords and other information stored in a vault at risk. LastPass warned customers on 20 January that it had made no such backup request and that its staff would never ask for a master password. Disruption of the initial infrastructure did not end the activity: LastPass reported replacement links on 22 January and another wave on 20 February. This is a scam with no software patch to install. As of 3 November, the sources reviewed disclose no victim or financial-loss total and no confirmed end to this campaign; its current activity is unknown.","action":"Ignore the backup request and open LastPass through your usual app or saved bookmark. Report suspicious messages to abuse@lastpass.com. If you entered your master password on a linked page, change it immediately through the genuine LastPass service and contact LastPass support for help securing your account.","product":"LastPass customers","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["lastpass","phishing","password-manager","credential-theft","email-scam"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"New Phishing Campaign Targeting LastPass Customers","url":"https://blog.lastpass.com/posts/new-phishing-campaign-targeting-lastpass-customers","by":"LastPass","date":"2026-01-20"},{"kind":"advisory","title":"January 2026 Phishing Campaign Targeting LastPass Customers [UPDATE]","url":"https://blog.lastpass.com/posts/january-2026-phishing-campaign-targeting-lastpass-customers-update","by":"LastPass","date":"2026-01-22"},{"kind":"advisory","title":"January 2026 Phishing Campaign Targeting LastPass Customers [FEBRUARY UPDATE]","url":"https://blog.lastpass.com/posts/january-2026-phishing-campaign-targeting-lastpass-customers-feb-update","by":"LastPass","date":"2026-02-20"},{"kind":"news","title":"Fake Lastpass emails pose as password vault backup alerts","url":"https://www.bleepingcomputer.com/news/security/fake-lastpass-emails-pose-as-password-vault-backup-alerts/","by":"BleepingComputer","date":"2026-01-21"},{"kind":"news","title":"LastPass ‘create backup’ email is a phishing scam targeting your master password","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/lastpass-create-backup-email-is-a-phishing-scam-targeting-your-master-password","by":"Bitdefender","date":"2026-01-22"}],"started":"2026-01-19","closed":"2026-02-20","created":"2026-11-03T21:55:32.390Z","updated":"2026-11-03T21:55:32.390Z","cve_notes":[],"timeline":[{"at":"2026-02-20","added":"2026-11-03T21:54:09.841Z","kind":"wider-attacks","text":"LastPass reported a further wave using the same subject lines and message body with replacement links after previous disruptions. It described the campaign as ongoing and published updated blocking information.","url":"https://blog.lastpass.com/posts/january-2026-phishing-campaign-targeting-lastpass-customers-feb-update","by":"LastPass","patch":null},{"at":"2026-01-22","added":"2026-11-03T21:54:09.841Z","kind":"wider-attacks","text":"LastPass reported another email wave after it and its partners disrupted the initial infrastructure. The messages retained the same body but used different links.","url":"https://blog.lastpass.com/posts/january-2026-phishing-campaign-targeting-lastpass-customers-update","by":"LastPass","patch":null},{"at":"2026-01-21","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"BleepingComputer reported that the initial phishing site appeared offline when it checked. This did not establish that the campaign had ended.","url":"https://www.bleepingcomputer.com/news/security/fake-lastpass-emails-pose-as-password-vault-backup-alerts/","by":"BleepingComputer","patch":null},{"at":"2026-01-20","added":"2026-11-03T21:54:09.841Z","kind":"disclosed","text":"LastPass warned customers that the backup request was fraudulent and its links led to a phishing site. The company said it was working with partners to take the site down.","url":"https://blog.lastpass.com/posts/new-phishing-campaign-targeting-lastpass-customers","by":"LastPass","patch":null},{"at":"2026-01-19","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"The campaign began on or around this date, according to LastPass. Fake maintenance emails told customers to back up their password vaults within 24 hours.","url":"https://blog.lastpass.com/posts/new-phishing-campaign-targeting-lastpass-customers","by":"LastPass","patch":"na"}],"url":"https://hard.fyi/live/lastpass-fake-maintenance-phishing-jan-2026/","json":"https://hard.fyi/api/live?id=lastpass-fake-maintenance-phishing-jan-2026"}