The bottom line: Phishing emails with fake compliance notifications attempt to lure LastPass and Bitwarden users to malicious websites to steal master passwords or distribute malware.
LastPass and Bitwarden are warning of an active phishing campaign designed to steal users’ master passwords. The forged emails impersonate official security notifications and redirect to pages offering malicious DocuSign software for download.
The phishing campaign uses the email domains lastpassnewsletter.com and bitwardennewsletter.com, which were registered on July 13, 2026. The emails impersonate official security notifications from both password managers and claim that users must confirm updated security policies. According to the message, failure to confirm will result in loss of access to the password vault.
Recipients who click on links in the emails are redirected to the domains lastpasscompliance.com and bitwardencompliance.com respectively. These pages replicate the user interface of DocuSign, the US-based digital signature service provider. Users are prompted to download what appears to be DocuSign software. Microsoft Defender for Office 365 and Cloudflare have already flagged the supplied file as malicious. The exact malicious functionality is not yet fully known.
LastPass stated that the identified domains have been taken offline while analysis of the download contents is underway. The company is working with partners to prevent further distribution.
For CISOs and security officers, it is critical to warn users against clicking on email links. Anyone who has already entered credentials on the phishing pages must immediately change their master password and check the password vault for unauthorized access. A review of email gateways for corresponding phishing emails and targeted user awareness training are strongly recommended.
Source: www.it-daily.net · Published July 20, 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.