Beware: LastPass impostors could steal your passwords

TLDR:

• LastPass issued a warning about a phishing campaign where hackers pose as LastPass staff to access customer password vaults.
• Threat actors are using the CryptoChameleon phishing kit to create fake sites imitating LastPass to trick users into sharing their credentials.

The article discusses how LastPass, the popular password manager, has alerted its users about a phishing campaign that involves hackers impersonating LastPass staff to gain access to customer password vaults. LastPass identified the use of the CryptoChameleon phishing kit by threat actors in this campaign. The kit allows threat actors to create fake single-sign-on pages imitating legitimate sites, leading users to hand over their credentials unknowingly.

LastPass was informed by data protection specialists Lookout that the CryptoChameleon phishing kit had added LastPass to its repertoire, and threat actors were observed using it to deceive victims. The phishing attacks typically involve directing victims to fake websites through various methods such as phishing emails, SMS messages, or even direct phone calls (vishing).

The tactics employed by the threat actors involve a phone call to the victim from an 888 number, informing them that their LastPass account has been accessed from a new device and instructing them to press a number to allow or block access. Victims who block access are then told that they will receive a call from a LastPass representative to resolve the issue. The scammers, posing as LastPass employees, then guide the victim to a phishing site through an email with a shortened URL, where the victim is prompted to enter their LastPass master password, giving the threat actor access to their account.

LastPass has collaborated with vendor partners to take down the phishing site and is advising customers to remain vigilant for future iterations of this campaign. By raising awareness about these phishing attacks and the tactics used by threat actors, LastPass aims to protect its customers from falling victim to such scams.