Fake LastPass and Bitwarden emails send users to bogus DocuSign pages
Criminals are impersonating two of the biggest password managers with polished 'policy update' emails that push a malicious file download.
Key points
- LastPass confirmed a phishing campaign impersonating its brand using the domain lastpasscompliance[.]com.
- The fake emails come from hello@lastpassnewsletter.com and claim LastPass has updated its service policies.
- Bitwarden customers are being hit with the same trick from hello@bitwardennewsletter.com, pointing to bitwardencompliance[.]com.
- LastPass says its own systems were not broken into and the emails did not come from its servers.
- The fake page offered a download for both Windows and macOS before it was taken offline.
Password managers are the keys to the kingdom. If a criminal gets your master password, they get every other password you own. A phishing run aimed at LastPass and Bitwarden customers is worth paying attention to.
LastPass has warned users about a live campaign of fake security notices, first reported by BleepingComputer. The emails look like a normal corporate update: new monitoring features, changes to how admins can reset master passwords, improvements to the admin console. There's a friendly button that says "Review & Access Terms".
Click it, and you land on a page dressed up to look like DocuSign, the service companies use to sign documents electronically. The real giveaway is the web address: lastpasscompliance[.]com, not a LastPass domain. Microsoft Defender for Office 365 and Cloudflare have both flagged it as malicious.
The fake page then tries to get you to download a file, with versions for Windows and macOS. LastPass couldn't confirm exactly what the file does. That usually means password-stealing malware or remote-access malware that lets the attacker into your machine. The site had a live chat box, though nobody confirmed whether a human was on the other end. It's since been pulled down.
Bitwarden users are getting the same treatment. Same template, same trick, different brand name in the sender address.
Should I be worried if I use LastPass or Bitwarden?
Only if you clicked. This is a phishing run, not a break-in at either company. LastPass has been clear that its infrastructure wasn't touched, and there's no sign Bitwarden's was either. The criminals are borrowing the brands, not the systems.
If you did click and typed your master password, act now. Change that master password from a device you trust, not the one that ran the download. Then open your vault and look for logins you don't recognise. Change anything sensitive: email, bank, work accounts. LastPass asks users to forward suspicious emails to abuse@lastpass.com and is clear it will never ask for your master password by email.
If you downloaded and ran the file, treat the machine as compromised and get it cleaned or reinstalled.
This isn't the first time LastPass customers have been in the crosshairs. In March the company warned about fake "unauthorised access" alerts designed to panic people into logging in on a fake page. Earlier, in January, there were bogus emails claiming users had 24 hours to back up their vaults before maintenance. The pattern is identical each time: urgency, a branded button, a lookalike domain. Our Ghost Phishing story from 8 July showed how phishing pages are increasingly designed to evade filters entirely, which makes the human layer the only reliable check.
The failure mode here isn't technical. A well-designed email with the right logo will beat a busy person every time.
One thing worth checking today: bookmark the real LastPass or Bitwarden login page in your browser and use only that bookmark. Never log in from a link in an email.
