LastPass warns users of new phishing campaign sending out fake support messages

• LastPass phishing campaign tricks victims out of their master passwords
• Fake maintenance email warns users to backup their vaults urgently
• "No one at LastPass will ever ask you for your master password"

LastPass has issued a warning about a new phishing campaign looking to trick users into handing over their master passwords and with that, potentially all of their passwords, 2FA codes, payment details and more.

A fake email warning of "scheduled maintenance" encourages users to backup their password manager vaults within 24 hours, only to steal their credentials.

This false sense of urgency is one of the most common ways to trip victims up into sharing credentials, rushing them past some basic checks that would highlight the dodgy activity.

LastPass users warned of January 2026 phishing campaign

"Please be advised that LastPass is NOT asking customers to backup their vaults in the next 24 hours," the company stressed. "Please remember that no one at LastPass will ever ask for your master password."

A genuine-looking email template covers all the essentials – a supposed commitment to security, instructions on how to perform the backup and contact methods for further questions.

However, there are some quick actions users can take before they fall victim. For example, sender addresses for the campaign include support@sr22vegas[.]com, support@lastpass[.]server8, support@lastpass[.]server7 and support@lastpass[.]server3.

LastPass promises to be working with third-party partners to take down the domains it's identified, and it encouraging users to report suspicious emails to abuse@lastpass.com.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.