You open your inbox and see a message about updated security policies. Nothing about it screams scam. The email looks polished, the wording sounds official and the button promises a quick way to review the changes. That is exactly what makes it dangerous.
LastPass is warning users about a newly identified phishing campaign that uses lookalike domains and a fake DocuSign page to lure people into downloading suspicious software.
The good news is that LastPass says its systems were not affected. The bad news is that scammers are counting on you to trust the logo, overlook the web address and click before taking a closer look. Here is what to watch for before one routine-looking email puts your entire password vault at risk.
Free live CyberGuy class: Sick of Spam? Join us July 22
Join us TODAY, Wednesday, July 22, at 1 PM ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt “CyberGuy” Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.
Reserve your free spot today at CyberGuyLive.com.
FBI HELPS TAKE DOWN AI PHISHING RING
LastPass phishing scam starts with a routine policy email
The phishing email comes from hello@lastpassnewsletter.com. Its known subject line reads, “Action Required: Review Updated LastPass Security Policies.” Inside, the message claims LastPass has made service policy changes. It mentions enhanced SaaS monitoring. It also claims administrators can reset master passwords and that the admin console has improved.
Those details make the email sound like a real company notice. However, the sending domain belongs to the attackers. LastPass says lastpassnewsletter[.]com has no affiliation with the company. The email includes a Review & Access Terms button. That button creates the next layer of the trap.
Clicking the button sends you to lastpasscompliance[.]com. The landing page copies the look of DocuSign and claims a document is ready for review. That choice makes sense from a scammer’s perspective. Many people receive electronic signature requests at work or while handling personal paperwork. A familiar layout can lower your guard before you inspect the web address.
We have seen the same trust trick in other fake DocuSign email scams. The brand name gives the request a sense of legitimacy, even when the sender and domain do not match. LastPass says Microsoft Defender for Office 365 and Cloudflare classified the phishing site as malicious. The page also prompted visitors to download software that claimed to work on Windows and macOS.
LastPass was still investigating the download when it published its warning. Therefore, you should treat the file as dangerous and avoid opening it. The site also displayed a live support chat box, although it was unclear whether the chat worked. The malicious page had gone offline by the time the campaign was reported. However, attackers can quickly replace blocked domains with new ones.
LastPass users are not the only targets. Bitwarden customers have received similar messages from hello@bitwardennewsletter.com. Those emails directed recipients to bitwardencompliance[.]com. The matching format suggests attackers may be reusing the same campaign structure across password manager brands.
That matters because password manager customers present an attractive target. One stolen master password could put many saved accounts at risk. Multi-factor authentication may still block access, depending on your security settings.
A password manager remains valuable protection. In fact, autofill can help expose a fake website because the manager should recognize the legitimate domain. You can compare current options in our guide to the best password managers for 2026 at cyberguy.com
This campaign follows other LastPass-themed phishing attempts from earlier this year. In January, fake messages warned that users had only 24 hours to back up their vaults before maintenance. Then, a March campaign used fabricated email threads about unauthorized account access.
Both approaches relied on urgency to push people into acting before they verified the message. The new compliance notice uses a calmer approach. It looks like paperwork rather than a crisis. That may make it especially effective because policy updates feel normal and boring.
REDHOOK ANDROID MALWARE CAN QUIETLY HIJACK YOUR PHONE
A few careful steps can keep one convincing email from turning into a much larger problem.
Delete the message or report it as phishing. Do not reply. Avoid opening its links or downloading the file it offers.
Use the official LastPass app or type lastpass.com into your browser. Check for account notices after you sign in through the trusted route.
Lookalike domains often add a trusted brand name to words such as “newsletter” or “compliance.” Check the website address before the first slash. A legitimate LastPass address should end in lastpass.com, such as support.lastpass.com, rather than merely containing the word “LastPass.”
A password manager may refuse to fill your credentials on a fake domain. Treat that as a warning. Do not copy and paste the password to get around it. Instead, close the page and access your account through the official app or website.
Use a trusted device and go directly to LastPass. Change the master password immediately. Then review your vault for unexpected activity, as LastPass recommends. Next, change passwords for sensitive accounts stored in the vault if you see signs of access. Start with email, financial accounts, cloud storage and social media. Use a different password for every account.
AMAZON RECALL TEXT SCAM COMES WITH RED FLAGS
Do not open software offered by a security notice you reached through email. If you already opened the file, disconnect the affected device from the internet. Then use strong antivirus software to inspect it. Our current best antivirus protection guide at cyberguy.com can help you compare tools that block malicious websites and dangerous downloads. It also covers protection against malware. You can also follow these steps after you clicked a suspicious email and entered information.
Enable multi-factor authentication for your password manager and other important accounts. An authenticator app or security key can add a barrier if someone steals your password. However, never approve a login request you did not initiate. A second security step only helps when you treat unexpected prompts as a warning.
Scammers often use information from data broker sites to make phishing emails feel more personal. That could include your phone number, home address, relatives or past employers. A data removal service can help find and remove some of that information from people-search websites. It will not secure a compromised password manager, but it may give scammers fewer details to use in future attacks. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com
Forward questionable LastPass-branded emails to abuse@lastpass.com. LastPass says no one from the company will ever ask for your master password.
What makes this scam dangerous is how normal the email looks. Most people expect password manager alerts to sound urgent. This one arrives dressed up as a boring policy update, which may make you less likely to question it. The biggest red flag is the web address. A company name inside a domain does not mean the company owns it. Before entering a master password or downloading anything, close the email and open the password manager directly. Your master password protects everything stored in your vault. Treat any request for it like someone asking for the keys to your house.
Have you ever received a security email that looked so real you almost clicked? What made you stop and take a closer look? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
