Phishing Scams Target Password Manager Users with Fake DocuSign Pages
Users of LastPass and Bitwarden are being warned of sophisticated phishing campaigns that use deceptive emails and websites to steal credentials.
A new phishing campaign is targeting users of password managers like LastPass and Bitwarden, employing fake security policy emails and deceptive DocuSign lookalike pages to trick individuals into downloading malicious software. The campaign aims to compromise user accounts by stealing master passwords, which could grant attackers access to a wide range of sensitive information.
The phishing emails, often originating from domains designed to mimic legitimate company communications, claim urgent action is required regarding updated security policies. For LastPass users, the emails come from addresses like [email protected] with subjects such as "Action Required: Review Updated LastPass Security Policies." These messages direct recipients to click a "Review & Access Terms" button.
This button leads to a fraudulent website, for example, lastpasscompliance[.]com, which is designed to resemble the familiar interface of DocuSign. This tactic exploits the common use of DocuSign for document signing, leveraging brand recognition to lower users' defenses. The fake DocuSign page prompts visitors to download software that purports to be compatible with Windows and macOS.
LastPass has stated that its systems were not affected by this campaign. However, the company warns that the downloaded file should be treated as dangerous. The malicious pages have been flagged as such by security services including Microsoft Defender for Office 365 and Cloudflare. While the specific phishing site reported may have been taken offline, attackers can quickly deploy new domains to continue their operations.
Similar phishing attempts have also been reported targeting Bitwarden users, with emails sent from [email protected] directing recipients to bitwardencompliance[.]com. This suggests a potential reuse of campaign infrastructure across different password manager brands, indicating that customers of these services are a prime target.
Password managers are attractive targets because a single compromised master password can unlock numerous stored accounts. While multi-factor authentication can provide an additional layer of security, users are advised to remain vigilant.
This recent campaign follows previous LastPass-themed phishing attempts, including those in January and March that used fabricated warnings about vault backups and unauthorized account access, respectively. The current method, appearing as a routine policy update, may be particularly effective due to its less urgent and more mundane nature.
To protect against these threats, users are advised to avoid clicking links or downloading files from suspicious emails. Instead, they should access their password manager accounts directly through official apps or by typing the correct website address into their browser. Users should carefully scrutinize the full web address of any site before entering credentials or downloading software. A password manager's autofill feature may also serve as a warning if it fails to populate credentials on a fake domain. If a master password has been entered on a compromised site, users should change it immediately via a trusted device and review their vault for any suspicious activity. Enabling multi-factor authentication and reducing the amount of personal information available online can further enhance security. LastPass encourages users to report suspicious emails to [email protected].