Don't click on the LastPass 'create backup' link - it's a scam

LastPass warned customers about an active phishing campaign (beginning ~Jan 19) that sends emails claiming scheduled maintenance and urging users to "backup their vaults" within 24 hours; links first redirect via an S3 URL then to a mail-lastpass.com domain that leads to a credential-harvesting phishing site designed to steal master passwords. The advisory includes malicious URLs, associated IPs, sender email addresses, and subject lines to aid threat hunting, and emphasizes that LastPass will never ask for a master password.