Phishers target 1Password users with convincing fake breach alert

Malwarebytes observed a targeted phishing campaign impersonating 1Password's Watchtower feature to steal password vault credentials. The phishing email originated from [email protected] and linked to the phishing domain onepass-word.com (routed via mandrillapp); vendors quickly classified the domain as malicious. The report highlights red flags, provides IOCs, and advises users to avoid clicking unsolicited links and to verify account status via the official 1Password site or app.