LastPass Warns of Fake Maintenance Messages Targeting Users’ Master Passwords - The Hacker News

LastPass Warns of Fake Maintenance Messages Targeting Users’ Master Passwords Ravie LakshmananJan 21, 2026Email Security / Malware LastPass is alerting users to a new active phishing campaign that's impersonating the password management service, which aims to trick users into giving up their master passwords. The campaign, which began on or around January 19, 2026, involves sending phishing emails claiming upcoming maintenance and urging them to create a local backup of their password vaults in the next 24 hours. The messages, LastPass said, come with the following subject lines - LastPass Infrastructure Update: Secure Your Vault Now Your Data, Your Protection: Create a Backup Before Maintenance Don't Miss Out: Backup Your Vault Before Maintenance Important: LastPass Maintenance & Your Vault Security Protect Your Passwords: Backup Your Vault (24-Hour Window) The emails are designed to steer unsuspecting users to a phishing site ("group-content-gen2.s3.eu-west-3.amazonaws[.]com/5yaVgx51ZzGf") that then redirects to the domain "mail-lastpass[.]com." The company emphasized that it will never ask users for their master passwords and that it's working with third-party partners to take the malicious infrastructure down. It has also shared the email addresses from which the messages originate - support@sr22vegas[.]com support@lastpass[.]server8 support@lastpass[.]server7 support@lastpass[.]server3 "This campaign is designed to create a false sense of urgency, which is one of the most common and effective tactics we see in phishing attacks, a spokesperson for the Threat Intelligence, Mitigation, and Escalation (TIME) team at LastPass told The Hacker News in a statement. "We want customers and the broader security community to be aware that LastPass will never ask for their master password or demand immediate action under a tight deadline. We thank our customers for staying vigilant and continuing to report suspicious activity." LastPass told The Hacker News that it's not aware of how many customers were targeted, and that there is no indication, at this time, that any accounts were compromised. It also said the use of widely available infrastructure has complicated attribution efforts, but noted that the "overall tactics and broad customer targeting aligns closest with cybercriminal groups." The development comes months after LastPass cautioned users of an information-stealing campaign targeting Apple macOS users through fake GitHub repositories that distribute malware-laced programs masquerading as the password manager and other popular software. Update LastPass said it has observed a fresh round of emails as of January 22, 2026, using similar tactics, but changing the URLs after the initial infrastructure was taken down. The new indicators of compromise (IoCs) are listed below - Phishing sites: systems-resources.s3.eu-west-3.amazonaws[.]com/sSvLaIvIEm5iMal security-lastpass[.]com Subject Lines: LastPass Server Maintenance: Backup Recommended LastPass Maintenance Scheduled: Here's What You Need to Do Critical: Please Backup Your LastPass Vault Before Maintenance LastPass Infrastructure Update: Secure Your Vault Now LastPass Maintenance: Secure Your Data Today Important: LastPass Maintenance & Your Vault Security Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  cybersecurity, email security, identity theft, MacOS, Malware, password manager, Phishing, Threat Intelligence Trending News Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI Model OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1 Starkiller Phishing Suite Uses AitM Reverse Proxy to Bypass Multi-Factor Authentication Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited ⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack and Vibe-Coded Malware ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday New Chrome Vulnerability Let Malicious Extensions Escalate Privileges via Gemini Panel Microsoft Reveals ClickFix Campaign Using Windows Terminal to Deploy Lumma Stealer 149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict ThreatsDay Bulletin: DDR5 Bot Scalping, Samsung TV Tracking, Reddit Privacy Fine and More Load More ▼ Popular Resources 19,053 Confirmed Breaches in 2025 – Key Trends and Predictions for 2026 Self-Hosted WAF: Block SQLi, XSS, and Bots Before They Reach Your Apps Read CYBER360 2026: From Zero Trust Limits to Data-Centric Security Paths Identity Controls Checklist: Find Missing Protections in Apps