Multiple LastPass Users Lose Master Passwords to Ultra-Convincing Scam

CryptoChameleon is an active, highly realistic phishing campaign that combined robo-calls and live, spoofed support agents with phishing pages to harvest LastPass master passwords and perform account takeover; Lookout identified at least eight victims and the campaign targeted both consumers and high-value enterprise users, with attackers persisting after domains were taken down and employing hands-on tactics to bypass MFA and user training.