LastPass, Bitwarden users targeted with fake security alerts

A phishing campaign is targeting LastPass and Bitwarden users with fake security notices sent from addresses like [email protected] and [email protected], redirecting victims to impersonated DocuSign sites (e.g., lastpasscompliance.com, bitwardencompliance.com) that prompt downloads and may harvest credentials. LastPass confirms its infrastructure was not compromised, the malicious sites have been taken offline, and users who entered credentials should change their master passwords and report suspicious communications.