LastPass & PhishLabs Work to Defend Customers from Phishing Scams

By The PhishLabs Group | September 26, 2023

One in every of our Digital Threat Safety service prospects, LastPass, is dedicated to monitoring the cyber risk surroundings to maintain our prospects as safe as attainable. To focus on this dedication, we wish to name consideration to latest joint efforts to disrupt a phishing marketing campaign concentrating on LastPass prospects and associates that started two weeks in the past. We’re sharing this with you not as a result of it’s a new or distinctive risk, however to underscore the efforts we’re taking to disrupt this risk and ones prefer it.

On the morning of September 13^th, LastPass prospects started reporting a pervasive and convincing phishing marketing campaign. The marketing campaign had international attain and focused quite a lot of sectors, together with 87 of our personal workers. The primary experiences we noticed coming in from our prospects arrived at roughly 9:34 am ET.  The e-mail originated from a sender handle referred to as “[email protected][.]th” and was related to a site that had not beforehand been linked to malicious exercise concentrating on LastPass previous to that morning.

The e-mail additionally included a hyperlink to a phishing web page hosted on subdomains of “customer-lastpass[.]su.” The marketing campaign was widespread but focused sufficient to attract consideration from the Data Safety neighborhood, together with a weblog put up calling out the emails from Malwarebytes printed the next day. In an effort to guard our prospects, this marketing campaign grew to become an instantaneous precedence for LastPass and our area monitoring and takedown vendor, Fortra’s PhishLabs, as quickly because it was detected.

Fig. 1: Instance of Redacted Phishing Electronic mail from September 13, 2023

Thankfully, LastPass’ Menace Intelligence, Mitigation, and Escalations group ceaselessly works with PhishLabs to guard our prospects from phishing campaigns precisely like this one by actively monitoring our domains. Actually, by the point the primary experiences began coming in from our prospects, a takedown request to every respective service supplier for the 2 suspicious domains was already underneath approach because the websites had been detected at roughly 8:55 am ET that morning. Moreover, the “lastpass[.]su” web site had been overtly marked for monitoring since September 3^rd, the day after it was registered. As quickly as the location went lively, LastPass, at the side of PhishLabs, was ready to start the mitigation course of instantly. Moreover, we had been in a position to pivot off the PDNS knowledge to proactively establish different domains which may be leveraged for future phishing campaigns and flag them for monitoring as properly.

Sadly, the risk actors materialized once more on September 19^th when the same subdomain for the credential phishing web site was registered, and several other new domains for the phishing emails had been leveraged. Once more, PhishLabs was in a position to establish these websites as quickly as they went lively, speedy takedown of the phishing subdomains (all falling underneath the area “last-pass[.]su”) inside simply 16 hours from the beginning of the marketing campaign’s second wave!

Whereas the velocity of takedown is commonly exterior the management of the focused firm and might fluctuate primarily based on the malicious area’s host, LastPass is proud that we had been in a position to work with PhishLabs to get fast and seamless affirmation of web site disruptions inside 48 hours or much less, thereby minimizing and containing the potential risk posed to our prospects. Moreover, PhishLabs shared these websites with main browsersthrough Fraudcast, serving to to fortify our prospects’ safety additional with one other layer of safety. Relaxation assured, LastPass is dedicated to persevering with to proactively defend our customers in partnership with this trusted vendor.

For extra info on steps you possibly can take to assist defend your self in opposition to phishing emails, please see this weblog put up from LastPass’ Chief Safe Expertise Officer, Christofer Hoff.  You may also discover extra technical particulars on our professional e mail domains right here.

Lastly, for LastPass prospects who wish to report a suspicious e mail, please ahead any questionable emails to [email protected] and our group will take the suitable motion from there.

Courtesy of the LastPass Weblog and written by Mike Kosak, Senior Principal Intelligence Analyst at LastPass.