LastPass in the Media

LastPass enters VPN market with password manager bundle

LastPass has launched a consumer VPN bundled with its password manager under a new LastPass Plus subscription, initially available through a standalone Windows desktop app. The VPN service launched today offers unlimited VPN traffic, support for up to 10 devices, and access to more than 100…

LastPass warns employees before they share sensitive data with AI tools

LastPass has announced an expansion of its Business Max offering to include AI Monitoring & Protect and Web Monitoring & Protect, new visibility and governance capabilities that enable organizations to identify and secure the AI tools, SaaS applications, and websites its employees…

ShinyHunters Hits the FBI, Fake LastPass Installers, and a $459M Google Fine: This Week's Cybersecurity Chaos

Come for ShinyHunters extorting rival hackers and breaching the FBI, stay for Google's $459M GDPR fine. Plus, is your VPN blocking which sites you can see?

Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools

Attackers spoofed LastPass on GitHub, used a Microsoft-signed driver to disable 145 security products, then deployed an infostealer. Someone impersonated LastPass on GitHub, got users to download a fake authenticator, and ended up killing 145 different antivirus and EDR products using a driver…

Microsoft-Signed Kernel Driver in Fake LastPass Authenticator Silences Defenses Before Password Theft

Attackers used a Microsoft-signed kernel driver in fake LastPass Authenticator downloads from GitHub to terminate 145 security tools from Ring 0. The Rapuncel stealer then…

New Rapuncel infostealer campaign uses fake GitHub repos to disable antivirus

The campaign, uncovered by LastPass and Delphos Labs, impersonates LastPass and at least 39 other companies.

Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords

Researchers uncovered a malware campaign that used a Microsoft-attested Windows kernel driver to turn off 145 antivirus and endpoint security processes, then stole passwords, cryptocurrency wallet data, browser sessions, and other sensitive information. LastPass Threat Intelligence, Mitigation…

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel. [...]

LastPass enhancements improve visibility, governance, and control

LastPass announced a series of strategic product innovations, customer experience enhancements, and industry milestones. These advancements reflect the company’s continued focus on providing practical tools to protect access and identity in an increasingly AI-driven threat landscape. Highlights…

Product showcase: LastPass Authenticator brings Face ID, Apple Watch, and cloud backup to 2FA

LastPass Authenticator is a free app that provides two-factor authentication (2FA) for accounts and any service that supports time-based one-time passwords (TOTP). It supports push notifications for one-tap approvals and generates six-digit verification codes for online accounts. The app is…

Fake password-manager alerts could put your vault at risk

LastPass warns of a phishing campaign using lookalike domains and a fake DocuSign page to trick users into downloading dangerous software.

M. Thénardier, LastPass, GitHub, EBS, Spirals, Pegasus, Shaft, Josh Marpet, and More - SWN #599

Podcast Segment: M. Thénardier, LastPass, GitHub, EBS, Spirals, Pegasus, Shaft, Josh Marpet, and More – SWN #599. M. Thénardier, LastPass, GitHub, EBS, Spirals, Pegasus, Shaft, Josh Marpet, and More on this episode of the Security Weekly News.

LastPass Says ‘Do Not Enter Your Credentials’ As New Attack Confirmed

LastPass users are being warned not to respond to a security alert email that looks like it comes from the password manager but is part of a credentials-stealing attack.

Security News This Week: LastPass Users Had Their Data Stolen—Again

Plus: Former national security advisor John Bolton pleads guilty in classified-materials case, Microsoft helps take down major infostealer infrastructure, and more.

New AI Scams Are Targeting You, LastPass Was Breached Again, and an Urgent Warning for Apple Owners

LastPass is back in the headlines, Apple users are facing a troubling hardware flaw, and AI is making life easier for scammers. Here's what happened in cybersecurity this week.

LastPass customer info leaked again after third-party data breach

LastPass users have been warned to look out for social engineering and phishing attacks that may attempt to swindle them out of their funds.

LastPass customer names, emails, and support records stolen in third-party breach, vaults unaffected

LastPass Breached Once Again, Hackers Gain Access to Sensitive Customer Data

Though the breached occurred at a third-party service provider, hackers used that access to steal LastPass customers' contact info and physical addresses.

LastPass confirms data breach after hacker compromises supply chain — here's what we know

Plenty of personal data obtained, but passwords seem to be safe.

LastPass customer data exposed through Klue supply chain attack

LastPass disclosed that attackers used OAuth tokens compromised in a supply chain attack on Klue, a market intelligence platform that integrates with CRM and sales tools across organizations, to access customer data stored in its Salesforce environment. “On June 12th LastPass was made aware of…

Another LastPass security breach traces back to a compromised vendor

LastPass warns customers after attackers stole support tickets and personal data via Klue.

LastPass suffers another data breach, but this time your password vault is safe

LastPass has confirmed that customer names, contact details, and support case records were exposed in a breach at Klue, though the company says password vaults remain secure.

LastPass has experienced a data breach again

Here we go again: On June 12th LastPass was made aware of an incident that occurred at Klue (klue.com), a third-party market intelligence platform utilized by our go-to-market teams which integrates with our Salesforce and Gong systems. The incident had a broad impact across many companies…

LastPass notifies users of yet another data breach

LastPass users are once again being warned about stolen personal data, though this time the breach happened…

LastPass user data stolen by hackers again

Password manager LastPass says a supply chain attack involving third-party vendor Klue exposed customer contact and support information, though customer vaults and stored credentials were not affected.

Password manager maker LastPass says hackers stole customer support case data during Klue breach

This is the second data breach to affect LastPass customers in recent years, after one of the password manager's tech partners was recently breached.

LastPass Customer Data Exposed in Klue Supply Chain Attack

LastPass has disclosed a supply chain security incident involving its third-party vendor, Klue, that resulted in unauthorized access to customer data within its Salesforce environment. The company confirmed that the breach did not affect its core infrastructure or password vaults. However, it…

LastPass says hackers stole customer data through a supply chain breach at Klue

LastPass is notifying customers that their personal information and customer support case data were stolen after hackers breached Klue, a competitive…

LastPass confirms data breach in Klue supply chain attack

LastPass announced that hackers accessed customer data from its Salesforce environment after stealing the company's OAuth tokens in the Klue supply chain attack earlier this month. [...]

LastPass Customer Data Exposed in Klue Supply Chain Attack Using Stolen OAuth Tokens

A security incident involving the third-party platform Klue has resulted in unauthorized access to limited customer data in LastPass. The breach occurred after attackers compromised OAuth tokens associated with enterprise integrations. This incident, disclosed by LastPass, underscores the…

New infosec products of the month: May 2026

Here’s a look at the most interesting products from the past month, featuring releases from Alation, AppOmni, Apricorn, ASAPP, Babel Street, Checksum, Cogent, CTERA, Forward, LastPass, Operant AI, Riverbed, Sysdig, Trust3 AI, TrustCloud, VIAVI, Versa Networks, and XM Cyber. Operant AI Endpoint…

I've been running Vaultwarden on my Proxmox home server for two years, and I don't miss LastPass

It keeps my passwords safe and my sanity intact

New infosec products of the week: May 8, 2026

Here’s a look at the most interesting products from the past week LastPass, Operant AI, Sysdig, and VIAVI. Operant AI Endpoint Protector secures AI agents and MCP tools Operant AI has launched Operant Endpoint Protector, a new addition to its AI Defense Platform that enables enterprise IT and…

LastPass Mobile Smart Scanner improves password security

LastPass has launched Mobile Smart Scanner, a solution that converts photographs of typed or handwritten credentials into structured, ready-to-use password entries that can be reviewed, saved, and autofilled directly from the vault. Available in early access for Free, Premium, and Family plan…

Does LastPass Owe You Money? Make Sure That Settlement Email Isn't a Scam

LastPass users are receiving emails about a data breach settlement—but how do you know if the message is legitimate? I'll show you how to spot fake settlement claim websites so you can get your money safely.

Affected by This LastPass Breach? How to Get a Cut of the $24.5M Settlement

Anyone who used LastPass prior to November 2022 should be eligible for a $25 payout, but some can get even more, provided you submit a claim by July 2.

FBI is investigating breach that may have hit its wiretapping tools

PLUS: Europol takes down two crime gangs; LastPass users phished (again); Crooks increase crypto hauls; And more Infosec In Brief The FBI is investigating a breach of its systems which reportedly affected systems related to wiretapping and surveillance.…

Hackers Are Trying to Steal LastPass Vault Details With Fake Support Emails

The emails ask the user to take some kind of action, such as disconnecting or locking their vault.

LastPass warns of scam using fake email chains spoofing account hacking 'to draw attention and generate urgency' in users

What would you do if you could eavesdrop on an ongoing social engineering attack against your LastPass account?

LastPass Review: Features, Pricing, Security, and Who It’s Best For

Read our LastPass review covering pricing, security, features, pros and cons, and whether LastPass is safe or free.

Cyberattack Alert: Hackers Impersonate LastPass Support to Steal Vault Passwords

A new phishing campaign impersonating LastPass support emails is targeting users to steal their vault passwords and account credentials. The phishing campaign uses fake email chains that appear to be forwarded internal messages about suspicious account activity. Attackers craft messages to make…

Fake LastPass support email threads try to steal vault passwords

Password management software provider LastPass is warning users of a phishing campaign targeting its users with fake unauthorized account access alerts. [...]

LastPass warns of spoofed alerts aimed at stealing master passwords

LastPass warns of a phishing campaign using fake security alerts about unauthorized access or password changes to steal users’ master passwords. LastPass has warned users about a new phishing campaign using fake security alerts that claim unauthorized access or master password changes. The emails…

LastPass Issues New Account Password Warning—Attacks Are Underway

LastPass has confirmed a new and ongoing attack that began on March 1 and targets user account credentials. Here’s what you need to know and do.

LastPass Warns of New Phishing Campaign

The attackers are sending out fake alerts claiming unauthorized access or master password changes.

LastPass warns of fake security alerts targeting account credentials

LastPass has warned customers about an ongoing phishing campaign that impersonates the company using fake email threads designed to trick recipients into revealing their credentials. The company says the activity began around March 1, 2026, and notes that its own systems were not compromised.…

Secure your business for less with 30% off LastPass plans

Deploy LastPass today and save 30%

Password Managers Vulnerable to Vault Compromise Under Malicious Server

Researchers at ETH Zurich have tested the security of Bitwarden, LastPass, Dashlane, and 1Password password managers.

25 Vulnerabilities Found in Cloud Password Managers, Exposing Users to Unauthorized Access and Changes

The three major cloud-based password managers, such as Bitwarden, LastPass, and Dashlane, collectively serve approximately 60 million users. Despite marketing claims of “zero-knowledge encryption,” the research team demonstrated that these platforms contained vulnerabilities…

Popular password managers fall short of “zero-knowledge” claims

Researchers from ETH Zurich have identified serious architectural weaknesses in three leading cloud-based password managers, Bitwarden, LastPass, and Dashlane, demonstrating that a fully compromised server could expose and even modify users’ stored credentials. Collectively, Bitwarden…

‘It's easier to tell them what hasn't changed in the last three to four years than what has’: LastPass CEO Karim Toubba on why it deserves your trust back after 2022 breach

LastPass has come a long way since the breach of 2022 - but has the company done enough to learn from its lessons?

Can you trust LastPass in 2026? Inside the multimillion-dollar quest to rebuild its security culture

After a string of high-profile breaches, the password manager's new CEO says security is now at the 'very heart' of what it does.