Incident : Phishing

LAS3302433101625

Exposure Impact

Title: Ongoing Phishing Campaign Targeting LastPass, Bitwarden, and 1Password Users with Fake Security Alerts

Description: An ongoing phishing campaign is targeting users of LastPass, Bitwarden, and 1Password with fake emails claiming that the companies were hacked. The emails urge recipients to download a supposedly more secure desktop version of the password manager, which instead installs the Syncro remote monitoring and management (RMM) tool. This tool is then used to deploy ScreenConnect, granting threat actors remote access to compromised systems. The campaign exploits social engineering tactics, including urgency and impersonation of official communications, to trick users into executing malicious binaries. Cloudflare is currently blocking access to the phishing landing pages.

Date Detected: 2023-10-09T00:00:00Z

Date Publicly Disclosed: 2023-10-09T00:00:00Z

Type: Phishing

Attack Vector: Email PhishingMalicious Binary DownloadLegitimate Tool Abuse (Syncro MSP, ScreenConnect)

Vulnerability Exploited: User trust in brand communications; exploitation of psychological urgency and fear tactics. No technical vulnerabilities in LastPass, Bitwarden, or 1Password systems were exploited.

Motivation: Financial GainCredential TheftData ExfiltrationPotential Follow-on Attacks (e.g., ransomware, fraud)

Incident : phishing

LAS1192211102425

Exposure Impact

Title: Phishing Campaign Targeting LastPass Users via Fake Legacy Inheritance Process

Description: LastPass is warning customers of a phishing campaign sending emails with an access request to the password vault as part of a legacy inheritance process. The activity, attributed to the financially motivated threat group CryptoChameleon (UNC5356), started in mid-October 2023 and has evolved to target passkeys as well. The phishing emails claim a family member requested access to the victim's LastPass vault via a fabricated death certificate, redirecting users to a fraudulent login page (lastpassrecovery[.]com) to steal credentials. In some cases, threat actors posed as LastPass staff to direct victims to the phishing site. The campaign also uses passkey-focused phishing domains like mypasskey[.]info and passkeysetup[.]com. This follows a 2022 data breach where encrypted vault backups were stolen, linked to subsequent cryptocurrency losses of ~$4.4 million.

Date Detected: mid-October 2023

Type: phishing

Attack Vector: email phishingfake inheritance requestvoice phishing (vishing)fraudulent login pages

Vulnerability Exploited: human trust in legacy inheritance processlack of multi-factor authentication (MFA) enforcement on phishing sitespasskey storage in password managers

Threat Actor: CryptoChameleon (UNC5356)

Motivation: financial gain (cryptocurrency theft)

Incident : Phishing LAS3302433101625

Entity Name: LastPass

Entity Type: Password Manager Provider

Industry: Cybersecurity

Location: Global

Customers Affected: Unknown (targeted users)

Incident : Phishing LAS3302433101625

Entity Name: Bitwarden

Entity Type: Password Manager Provider

Industry: Cybersecurity

Location: Global

Customers Affected: Unknown (targeted users)

Incident : Phishing LAS3302433101625

Entity Name: 1Password

Entity Type: Password Manager Provider

Industry: Cybersecurity

Location: Global

Customers Affected: Unknown (targeted users)

Incident : Phishing LAS3302433101625

Entity Name: End Users

Entity Type: Individuals/Organizations

Industry: Multiple

Location: Global

Incident : phishing LAS1192211102425

Entity Name: LastPass

Entity Type: password manager service

Industry: cybersecurity

Location: global (users worldwide)

Customers Affected: unknown (campaign described as 'extensive')

Incident : Phishing LAS3302433101625

Incident Response Plan Activated: ['LastPass issued a threat alert', 'Cloudflare blocked phishing landing pages']

Third Party Assistance: Cloudflare (Blocking Phishing Pages), Malwarebytes (Analysis Of 1Password Campaign).

Containment Measures: Cloudflare blocking phishing domains (lastpasspulse[.]blog, lastpasjournal[.]blog, bitwardenbroadcast.blog, onepass-word[.]com)Public advisories from LastPass and cybersecurity researchers

Remediation Measures: User education on verifying official communicationsEncouragement to report phishing attempts

Communication Strategy: LastPass blog post clarifying no breach occurredMedia coverage by BleepingComputer and MalwarebytesSocial media warnings

Incident : phishing LAS1192211102425

Incident Response Plan Activated: likely (public warning issued)

Containment Measures: public advisory to userswarning about phishing domains

Communication Strategy: blog postmedia alerts

Incident : Phishing LAS3302433101625

Type of Data Compromised: Potential password vault credentials, System access (via screenconnect), User activity logs

Sensitivity of Data: High (passwords, potentially payment info, PII)

Data Exfiltration: Likely (if threat actors accessed vaults or deployed additional malware)

Personally Identifiable Information: High risk (if stored in password vaults)

Incident : phishing LAS1192211102425

Type of Data Compromised: Master passwords, Passkeys, Potential vault data (if credentials reused)

Sensitivity of Data: high (passwords, cryptographic keys, financial access)

Data Exfiltration: likely (if credentials entered on phishing sites)

Data Encryption: N/A (credentials voluntarily entered by users on fake sites)

Personally Identifiable Information: high risk (if vaults accessed)

Incident : Phishing LAS3302433101625

Lessons Learned: Threat actors increasingly abuse legitimate tools (e.g., Syncro, ScreenConnect) to evade detection., Social engineering remains highly effective, especially when exploiting urgency (e.g., fake security alerts)., Holiday weekends are prime targets for phishing campaigns due to reduced staffing., User education on verifying official communications is critical, even for security-savvy audiences., Password manager users are high-value targets due to the sensitivity of stored credentials.

Incident : phishing LAS1192211102425

Lessons Learned: Threat actors are increasingly targeting passwordless authentication methods (e.g., passkeys) and exploiting psychological triggers (e.g., inheritance processes). Legacy features in security products can become attack vectors if not rigorously secured against social engineering. User education remains critical to combat sophisticated phishing.

Incident : Phishing LAS3302433101625

Recommendations: Always verify security alerts by logging into official websites (not via email links)., Enable multi-factor authentication (MFA) for password managers and associated email accounts., Use hardware security keys where possible to mitigate phishing risks., Monitor for unusual activity in password vaults (e.g., unexpected logins or changes)., Organizations should block or restrict unauthorized RMM tools (e.g., Syncro, ScreenConnect) unless explicitly whitelisted., Deploy email security solutions to detect and quarantine phishing messages impersonating trusted brands., Conduct regular phishing simulations to train users on recognizing social engineering tactics.Always verify security alerts by logging into official websites (not via email links)., Enable multi-factor authentication (MFA) for password managers and associated email accounts., Use hardware security keys where possible to mitigate phishing risks., Monitor for unusual activity in password vaults (e.g., unexpected logins or changes)., Organizations should block or restrict unauthorized RMM tools (e.g., Syncro, ScreenConnect) unless explicitly whitelisted., Deploy email security solutions to detect and quarantine phishing messages impersonating trusted brands., Conduct regular phishing simulations to train users on recognizing social engineering tactics.Always verify security alerts by logging into official websites (not via email links)., Enable multi-factor authentication (MFA) for password managers and associated email accounts., Use hardware security keys where possible to mitigate phishing risks., Monitor for unusual activity in password vaults (e.g., unexpected logins or changes)., Organizations should block or restrict unauthorized RMM tools (e.g., Syncro, ScreenConnect) unless explicitly whitelisted., Deploy email security solutions to detect and quarantine phishing messages impersonating trusted brands., Conduct regular phishing simulations to train users on recognizing social engineering tactics.Always verify security alerts by logging into official websites (not via email links)., Enable multi-factor authentication (MFA) for password managers and associated email accounts., Use hardware security keys where possible to mitigate phishing risks., Monitor for unusual activity in password vaults (e.g., unexpected logins or changes)., Organizations should block or restrict unauthorized RMM tools (e.g., Syncro, ScreenConnect) unless explicitly whitelisted., Deploy email security solutions to detect and quarantine phishing messages impersonating trusted brands., Conduct regular phishing simulations to train users on recognizing social engineering tactics.Always verify security alerts by logging into official websites (not via email links)., Enable multi-factor authentication (MFA) for password managers and associated email accounts., Use hardware security keys where possible to mitigate phishing risks., Monitor for unusual activity in password vaults (e.g., unexpected logins or changes)., Organizations should block or restrict unauthorized RMM tools (e.g., Syncro, ScreenConnect) unless explicitly whitelisted., Deploy email security solutions to detect and quarantine phishing messages impersonating trusted brands., Conduct regular phishing simulations to train users on recognizing social engineering tactics.Always verify security alerts by logging into official websites (not via email links)., Enable multi-factor authentication (MFA) for password managers and associated email accounts., Use hardware security keys where possible to mitigate phishing risks., Monitor for unusual activity in password vaults (e.g., unexpected logins or changes)., Organizations should block or restrict unauthorized RMM tools (e.g., Syncro, ScreenConnect) unless explicitly whitelisted., Deploy email security solutions to detect and quarantine phishing messages impersonating trusted brands., Conduct regular phishing simulations to train users on recognizing social engineering tactics.Always verify security alerts by logging into official websites (not via email links)., Enable multi-factor authentication (MFA) for password managers and associated email accounts., Use hardware security keys where possible to mitigate phishing risks., Monitor for unusual activity in password vaults (e.g., unexpected logins or changes)., Organizations should block or restrict unauthorized RMM tools (e.g., Syncro, ScreenConnect) unless explicitly whitelisted., Deploy email security solutions to detect and quarantine phishing messages impersonating trusted brands., Conduct regular phishing simulations to train users on recognizing social engineering tactics.

Incident : phishing LAS1192211102425

Recommendations: Enable multi-factor authentication (MFA) for all critical accounts, including password managers., Verify inheritance/access requests through out-of-band channels (e.g., phone calls to trusted contacts)., Use hardware security keys (e.g., YubiKey) for passkey storage to resist phishing., Monitor for suspicious domains spoofing legitimate services (e.g., lastpassrecovery[.]com)., Implement delays or additional verification for high-risk actions like inheritance requests., Educate users on recognizing vishing (voice phishing) tactics.Enable multi-factor authentication (MFA) for all critical accounts, including password managers., Verify inheritance/access requests through out-of-band channels (e.g., phone calls to trusted contacts)., Use hardware security keys (e.g., YubiKey) for passkey storage to resist phishing., Monitor for suspicious domains spoofing legitimate services (e.g., lastpassrecovery[.]com)., Implement delays or additional verification for high-risk actions like inheritance requests., Educate users on recognizing vishing (voice phishing) tactics.Enable multi-factor authentication (MFA) for all critical accounts, including password managers., Verify inheritance/access requests through out-of-band channels (e.g., phone calls to trusted contacts)., Use hardware security keys (e.g., YubiKey) for passkey storage to resist phishing., Monitor for suspicious domains spoofing legitimate services (e.g., lastpassrecovery[.]com)., Implement delays or additional verification for high-risk actions like inheritance requests., Educate users on recognizing vishing (voice phishing) tactics.Enable multi-factor authentication (MFA) for all critical accounts, including password managers., Verify inheritance/access requests through out-of-band channels (e.g., phone calls to trusted contacts)., Use hardware security keys (e.g., YubiKey) for passkey storage to resist phishing., Monitor for suspicious domains spoofing legitimate services (e.g., lastpassrecovery[.]com)., Implement delays or additional verification for high-risk actions like inheritance requests., Educate users on recognizing vishing (voice phishing) tactics.Enable multi-factor authentication (MFA) for all critical accounts, including password managers., Verify inheritance/access requests through out-of-band channels (e.g., phone calls to trusted contacts)., Use hardware security keys (e.g., YubiKey) for passkey storage to resist phishing., Monitor for suspicious domains spoofing legitimate services (e.g., lastpassrecovery[.]com)., Implement delays or additional verification for high-risk actions like inheritance requests., Educate users on recognizing vishing (voice phishing) tactics.Enable multi-factor authentication (MFA) for all critical accounts, including password managers., Verify inheritance/access requests through out-of-band channels (e.g., phone calls to trusted contacts)., Use hardware security keys (e.g., YubiKey) for passkey storage to resist phishing., Monitor for suspicious domains spoofing legitimate services (e.g., lastpassrecovery[.]com)., Implement delays or additional verification for high-risk actions like inheritance requests., Educate users on recognizing vishing (voice phishing) tactics.

Incident : Phishing LAS3302433101625

Source: BleepingComputer

URL: https://www.bleepingcomputer.com

Date Accessed: 2023-10-09

Incident : Phishing LAS3302433101625

Source: LastPass Threat Alert

Date Accessed: 2023-10-09

Incident : Phishing LAS3302433101625

Source: Malwarebytes (1Password campaign analysis)

URL: https://www.malwarebytes.com

Date Accessed: 2023-10-09

Incident : Phishing LAS3302433101625

Source: Hoax-Slayer (1Password phishing report)

Date Accessed: 2023-09-25

Incident : phishing LAS1192211102425

Source: LastPass Blog

Incident : Phishing LAS3302433101625

Investigation Status: Ongoing (analysis of malware samples and phishing infrastructure)

Incident : phishing LAS1192211102425

Investigation Status: ongoing (active campaign as of April 2024)

Incident : Phishing LAS3302433101625

Stakeholder Advisories: Lastpass: Clarified No Breach Occurred; Urged Users To Ignore Fake Emails., Bitwarden: No Official Statement Yet (As Of Report)., 1Password: No Official Statement Yet (As Of Report)., Cybersecurity Community: Shared Indicators Of Compromise (Iocs) And Tactical Advice..

Customer Advisories: Do not download software from email links; always use official app stores or websites.Report phishing emails to the password manager provider and email service.Check for unusual activity in password vaults or connected devices.Never share master passwords or 2FA codes, even if prompted by seemingly official emails.

Incident : phishing LAS1192211102425

Stakeholder Advisories: Public warning issued to LastPass users.

Customer Advisories: Users advised to ignore inheritance requests unless independently verified, avoid entering credentials on linked sites, and report suspicious activity.

Incident : Phishing LAS3302433101625

Entry Point: Phishing emails with malicious binary attachments (disguised as password manager updates)

Reconnaissance Period: Likely minimal (opportunistic campaign targeting broad user base)

Backdoors Established: ['Syncro MSP agent (hidden system tray icon)', 'ScreenConnect remote access tool']

High Value Targets: Password Vault Credentials, Saved Payment Information, Corporate/Enterprise Users With Elevated Access,

Data Sold on Dark Web: Password Vault Credentials, Saved Payment Information, Corporate/Enterprise Users With Elevated Access,

Incident : phishing LAS1192211102425

Entry Point: phishing emails (legacy inheritance requests)

Reconnaissance Period: likely extensive (group known for targeting crypto wallets since at least 2022)

High Value Targets: Cryptocurrency Wallet Credentials, Passkeys, Password Vaults,

Data Sold on Dark Web: Cryptocurrency Wallet Credentials, Passkeys, Password Vaults,

Incident : Phishing LAS3302433101625

Root Causes: Lack Of User Awareness About Phishing Tactics Impersonating Trusted Brands., Abuse Of Legitimate Rmm Tools (Syncro, Screenconnect) To Bypass Security Controls., Exploitation Of Psychological Triggers (Urgency, Fear) In Email Lures., Timing Of Campaign During Holiday Weekend To Delay Detection/Response.,

Corrective Actions: Enhanced Email Filtering For Impersonation Attacks Targeting Password Managers., Blocklist Known Malicious Domains (E.G., Lastpasspulse[.]Blog, Bitwardenbroadcast.Blog)., User Training On Verifying Software Updates And Security Alerts., Restrict Execution Of Unauthorized Rmm Tools Via Endpoint Protection., Monitor For Unusual Installations Of Screenconnect Or Syncro Agents.,

Incident : phishing LAS1192211102425

Root Causes: Exploitation Of Trust In Lastpass'S Legacy Inheritance Feature., Lack Of Robust Verification For High-Risk Access Requests., Passkey Storage In Password Managers Becoming A Target For Credential Theft., User Susceptibility To Social Engineering (Urgency, Authority Impersonation).,