Hackers Mimic LastPass Support Email to Steal Vault Passwords

A targeted phishing campaign (began ~March 1, 2026) is impersonating LastPass support by forwarding fabricated email chains and using display-name spoofing to trick users into visiting redirected links that land on fake LastPass SSO pages (e.g., verify-lastpass.com variants) to capture master passwords; the report lists malicious sender domains and IPs, and LastPass issued an advisory and mitigation guidance to users.