Fake LastPass and Bitwarden security alerts lure users to phishing sites

LastPass is warning that attackers are impersonating it and Bitwarden with fake security alerts to lure password-manager users to phishing sites. The emails, sent from look-alike domains rather than the real services, mimic corporate notices about updated security policies and push recipients to a page impersonating DocuSign. LastPass stresses its systems were not breached and the messages did not come from its infrastructure. Password managers are attractive phishing targets because compromising one can unlock every stored credential, and users often trust vendor-branded alerts. Related campaigns have pushed fake more-secure desktop apps that actually install remote-access tools, and similar lures have impersonated other password managers.

Check

Remind users that password-manager vendors do not ask for the master password, and to verify any breach or policy alert by logging in through the official site or app, not emailed links.

Affected

LastPass and Bitwarden users, and by extension every credential in their vaults; convincing vendor-branded alerts from look-alike domains can trick them into entering their master password or installing remote-access malware.

Fix

Verify security notices through official portals, enable phishing-resistant multi-factor authentication on password managers, and if credentials were entered on a phishing site, change the master password from a trusted device.