LastPass, the popular password management service, has issued an urgent warning to its users about an ongoing social engineering campaign targeting customers through fake reviews on the Chrome Web Store.
The CryptoChameleon phishing kit is being leveraged by vishing attackers looking to trick LastPass users into sharing their master password.
LastPass and its affiliate GoTo (formerly LogMeIn) have suffered a security incident / breach and the investigation is undeway.
LastPass says the attacker behind the August security breach had internal access to the company's systems for four days until they were detected and evicted.
LastPass denied any cyberattack and deemed the exposure of master passwords a result of possible credential stuffing attack.
LastPass has no idea what these trackers in the Android app do. They emphasize the app shares no data with third-parties.
LastPass has announced that it is bringing a new 'Security Dashboard' for all users that helps them monitor passwords. It is also adding dark web monitoring for Premium, Families, and businesses.
