04/19/2024
LastPass Phishing Scam Warning
There are more problems with LastPass™. The company issued a warning to customers about a recent phishing scam. The scam targeted LastPass users, tricking them into revealing their master passwords. Attackers then gained access to their accounts. The phishing scam was linked to the use of the advanced CryptoChameleon phishing kit, which allows malicious actors to create counterfeit login pages that mimic legitimate websites or companies.
Tactics Used in the Campaign:
• Spoofed Call as LastPass™ “888” number comes in claiming LastPass account accessed from new device, instructing recipient to press specific numbers to allow/block access.
• A recorded messages explains a call will be coming in about the potential victim’s account being compromised.
• If the recipient follows instructions of the Spoofed call impersonating LastPass employee, they will receive a Phishing email (looks legitimate to advanced users) with shortened URL to reset account access. The url is mimicking and tricky as well.
• If recipient enters master password on phishing site, threat actor attempts to log in to LastPass account and make changes to lock out user and then take control of account. This includes LastPass™ account functions including altering phone numbers, email addresses, and master password.
LastPass™ advice is vigilant: Stay vigilant for future variations of this scam using similar tactics. Preventive Measures: Follow these best practices to protect against phishing scams: 1. Never reveal the master password to anyone. 2. Use anti-virus and anti-malware software. 3. Avoid clicking on links in unsolicited emails. For more information see the blog post on LastPass™ website https://blog.lastpass.com/posts/2024/04/advanced-phishing-kit-adds-lastpass-branding-for-use-in-phishing-campaigns.
Advice from Agility Network Services, Inc.
Agility does not recommend using password managers that have web-based interfaces due to the inherent risks associated with the convenience of the master databases being available from anywhere on the Internet.