What Is Happening
The consequences of last year’s LastPass breach continue to impact users, as evidenced by a recent phishing email targeting LastPass users.
The breach involved an “unauthorized party” compromising user data, including password vaults. While cracking strong passwords is challenging, attackers have found a different approach: phishing.
LastPass users are being targeted by a highly convincing phishing email that attempts to steal their passwords. The email claims that users need to verify their personal data to maintain access to their LastPass accounts. It includes a link to a phishing site that closely mimics the real LastPass login page.
How Does the Attack Work
Criminals who gained access to LastPass users’ data, including email addresses, basic customer information, company names, end-user names, billing addresses, telephone numbers, and IP addresses, are now using this information for phishing attacks.
They send convincing and high-quality phishing emails to users, attempting to steal the passwords needed to unlock the stolen password vaults.
The phishing email tricks users into clicking on a link and entering their login credentials on the fake LastPass login page.
The attackers then capture the entered information, potentially gaining access to the users’ LastPass accounts.
The email and the phishing site are designed to appear legitimate, making it difficult for users to identify them as fraudulent.
Recommendations
Key highlights from the guidance provided by UK National Cyber Security Center:
Layer 1: Make it difficult for attackers to reach your users
- Use anti-spoofing controls like DMARC, SPF, and DKIM for email security.
- Limit the information available online about your organization.
- Implement email filtering and blocking to stop phishing emails.
Layer 2: Help users identify and report suspected phishing emails
- Recognize that spotting phishing emails is challenging.
- Encourage a culture of reporting phishing attempts.
- Provide ongoing training and awareness.
- Help users identify fraudulent requests.
Layer 3: Protect your organization from the effects of undetected phishing emails
- Protect devices from malware with updates and limited admin privileges.
- Guard against malicious websites.
- Enhance authentication with multi-factor verification.
- Review and optimize password policies.
Layer 4: Respond quickly to incidents
- Educate users on reporting incidents.
- Establish a security logging system.
- Develop and practice an incident response plan.
