Fake LastPass support email chains target customers’ logins and vault master passwords
Scammers sent LastPass customers fake support conversations about unauthorised account changes, linking to password-stealing pages. Open LastPass directly, ignore the email links and never disclose your master password. LastPass said its systems were unaffected.
Ignore links in these messages and open LastPass through your usual app or saved bookmark. Never disclose your master password, and forward suspicious emails to [email protected]. If you entered credentials on a linked page, contact LastPass support through its official website immediately.
What’s happening
A phishing campaign beginning around 1 March 2026 targeted LastPass customers with fabricated support conversations about unauthorised account activity. The messages pretended someone was exporting a password vault, recovering an account or registering a device, then urged recipients to intervene through supplied links. Those links led to counterfeit LastPass login pages intended to collect login details and vault master passwords. Sender names impersonated LastPass while the underlying email addresses belonged to unrelated domains. LastPass publicly warned customers on 3 March, said its systems were unaffected and began working with partners to remove the sites. This was a scam requiring customer precautions, with no software patch involved. As at 3 November, the reviewed sources provided no confirmed victim or loss totals, completed takedown or campaign end.
- What
- Scam
- Affects
- LastPass customers
- Fixed in
- Nothing to patch
- Since
- 1 Mar 2026
- Closed
- 4 Mar 2026
Timeline
- Update
BleepingComputer reported that the fake support threads directed customers to credential-stealing login pages. Site removals were still described as work in progress.
- Made public
LastPass warned customers about the active campaign and said its systems were unaffected. It was working with partners to have the phishing sites removed.
- UpdateNothing to patch
LastPass says the campaign began around this date. Fabricated email conversations claimed someone was making unauthorised changes to recipients’ accounts.
Sources
- LastPass Alerts Customers of Fake Email Chains Used in New Phishing Campaign; No Impact to LastPass SystemsLastPass · 3 Mar 2026
- Fake LastPass support email threads try to steal vault passwordsBleepingComputer · 4 Mar 2026
- LastPass Warns of New Phishing CampaignSecurityWeek · 4 Mar 2026