Fake password-manager alerts could put your vault at risk

Scammers are impersonating LastPass with fake policy emails that lead users to a fraudulent DocuSign page and suspicious software download.(Kurt “CyberGuy” Knutsson)

LastPass phishing scam starts with a routine policy email

The phishing email comes from [email protected] known subject line reads,“Action Required: Review Updated LastPass Security Policies.”Inside, the message claims LastPass has made service policy changes.It mentions enhanced SaaS monitoring.It also claims administrators canreset master passwordsand that the admin console has improved.

Those details make the email sound like a real company notice.However, the sending domain belongs to the attackers.LastPass sayslastpassnewsletter[.]comhas no affiliation with the company.The email includes aReview &Access Termsbutton.That button creates the next layer of the trap.

Fake LastPass page sends you to a DocuSign lookalike

Clicking the button sends you tolastpasscompliance[.]com.The landing page copies the look of DocuSign and claims a document is ready for review.That choice makes sense from a scammer’s perspective.Many people receive electronic signature requests at work or while handling personal paperwork.A familiar layout can lower your guard before you inspect the web address.

We have seen the same trust trick in otherfake DocuSign email scams.The brand name gives the request a sense of legitimacy, even when the sender and domain do not match.LastPass says Microsoft Defender for Office 365 and Cloudflare classified the phishing site as malicious.The page also prompted visitors to download software that claimed to work on Windows and macOS.

LastPass was still investigating the download when it published its warning.Therefore, you should treat the file as dangerous and avoid opening it.The site also displayed a live support chat box, although it was unclear whether the chat worked.The malicious page had gone offline by the time the campaign was reported.However, attackers can quickly replace blocked domains with new ones.

Similar Bitwarden emails widen the warning

LastPass users are not the only targets.Bitwarden customers have received similar messages from [email protected] emails directed recipients tobitwardencompliance[.]com.The matching format suggests attackers may be reusing the same campaign structure across password manager brands.

That matters because password manager customers present an attractive target.One stolen master password could put many saved accounts at risk.Multi-factor authenticationmay still block access, depending on your security settings.

Apassword managerremains valuable protection.In fact, autofill can help expose a fake website because the manager should recognize the legitimate domain.You can compare current options in our guide to the best password managers for 2026 atcyberguy.com

LastPass users have faced several phishing lures in 2026

This campaign follows other LastPass-themed phishing attempts from earlier this year.In January, fake messages warned that users had only 24 hours to back up their vaults before maintenance.Then, a March campaign used fabricated email threads about unauthorized account access.

Both approaches relied on urgency to push people into acting before they verified the message.The new compliance notice uses a calmer approach.It looks like paperwork rather than a crisis.That may make it especially effective because policy updates feel normal and boring.

REDHOOK ANDROID MALWARE CAN QUIETLY HIJACK YOUR PHONE

Ways to stay safe from the LastPass phishing scam

The fraudulent page impersonates DocuSign and prompts visitors to download suspicious software for Windows or macOS.(LastPass)

A few careful steps can keep one convincing email from turning into a much larger problem.

Read More → Would this survival pod make you feel safer?

1) Do not click the policy review button

Delete the message or report it as phishing.Do not reply.Avoid opening its links or downloading the file it offers.

2) Open LastPass on your own

Use the official LastPass app or typelastpass.cominto your browser.Check for account notices after you sign in through the trusted route.

Read More → AP post on USAID cuts backfires as critics question taxpayer-funded Nepal transgender jobs

3) Read the full domain before entering anything

Lookalike domains often add a trusted brand name to words such as “newsletter” or “compliance.” Check the website address before the first slash.A legitimate LastPass address should end in lastpass.com, such as support.lastpass.com, rather than merely containing the word “LastPass.”

4) Pay attention when autofill stays silent

A password manager may refuse to fill your credentials on a fake domain.Treat that as a warning.Do not copy and paste the password to get around it.Instead, close the page and access your account through the official app or website.

5) Change your master password if you entered it

Use a trusted device and go directly to LastPass.Change the master password immediately.Then review your vault for unexpected activity, as LastPass recommends.Next, change passwords for sensitive accounts stored in the vault if you see signs of access.Start with email, financial accounts, cloud storage and social media.Use a different password for every account.

AMAZON RECALL TEXT SCAM COMES WITH RED FLAGS

The scam relies on polished security notices, familiar branding and misleading web addresses to lower users’ defenses.(Kurt “CyberGuy” Knutsson)

6) Treat the download as dangerous

Do not open software offered by a security notice you reached through email.If you already opened the file, disconnect the affected device from the internet.Then usestrong antivirus softwareto inspect it.Our current best antivirus protection guide atcyberguy.comcan help you compare tools that block malicious websites and dangerous downloads.It also covers protection against malware.You can also follow these steps after youclicked a suspicious email and entered information.

7) Turn on multi-factor authentication

Enable multi-factor authentication for your password manager and other important accounts.Anauthenticator appor security key can add a barrier if someone steals your password.However, never approve a login request you did not initiate.A second security step only helps when you treat unexpected prompts as a warning.

8) Reduce the personal information scammers can find

Scammers often use information from data broker sites to make phishing emails feel more personal.That could include your phone number, home address, relatives or past employers.A data removal service can help find and remove some of that information from people-search websites.It will not secure a compromised password manager, but it may give scammers fewer details to use in future attacks.Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visitingCyberguy.com

9) Report suspicious LastPass messages

Forward questionable LastPass-branded emails to[email protected].LastPass says no one from the company will ever ask for your master password.

Kurt’s key takeaways

What makes this scam dangerous is how normal the email looks.Most people expect password manager alerts to sound urgent.This one arrives dressed up as a boring policy update, which may make you less likely to question it.The biggest red flag is the web address.A company name inside a domain does not mean the company owns it.Before entering a master password or downloading anything, close the email and open the password manager directly.Your master password protects everything stored in your vault.Treat any request for it like someone asking for the keys to your house.

Have you ever received a security email that looked so real you almost clicked?What made you stop and take a closer look?Let us know by writing to us atCyberguy.com

onelink.me/xLDS?pid=AppArticleLink&af_web_dp=https%3A%2F%2Fwww.

Sign up for my FREE CyberGuy Report

• Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
• For simple, real-world ways to spot scams early and stay protected, visitCyberGuy.com–trusted by millions who watch CyberGuy on TV daily.
• Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Copyright 2026 CyberGuy.com.All rights reserved.

Kurt “CyberGuy�Friends.” Got a tech question?Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.