You might have seen <a href="https://www.gartner.com/en/newsroom/press-releases/2023-03-28-gartner-unveils-top-8-cybersecurity-predictions-for-2023-2024">this shocking prediction from Gartner:</a> by 2027, 75% of employees will acquire, modify or create technology outside IT&rsquo;s visibility &ndash; up from 41% in 2022.&nbsp;
Your employees rely on more SaaS tools than ever and not all of them are on your radar. &nbsp; 
From cloud apps and browser extensions to AI tools, today&rsquo;s workplaces move fast. And when anyone can implement a new app with little more than a credit card and a dream, you can be sure that very few of them are thinking about access or credential management. Consider this:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Shadow IT and Shadow AI are expanding the attack surface, with unsanctioned tools introducing security gaps no one&rsquo;s monitoring.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">App bloat is costing real money &mdash; small businesses now pay for an average of 134 unused applications, and large organizations pay for 473.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Sensitive data is slipping through the cracks, with 38% of employees admitting they&rsquo;ve shared work information with unauthorized AI tools.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Compliance is harder to maintain when there&rsquo;s no clear picture of who&rsquo;s accessing what, and from where.&nbsp;</li>
</ul>
Single sign-on (SSO) can help with your core apps-- the ones that you know about-- but it doesn&rsquo;t cover everything, especially those smaller, hidden apps. And for small and mid-sized businesses, controlling those can get expensive and time-consuming, fast.&nbsp;&nbsp;
That&rsquo;s where the security gaps start. Without a simple, customizable way to manage access, secure credentials and monitor app usage, it&rsquo;s easy to lose control. And that opens the door to risk from old accounts that still have access to sensitive info, to apps no one remembers signing up for.&nbsp;
It&rsquo;s no longer enough to secure passwords alone. Businesses need an approach to identity and access management that&rsquo;s as flexible, efficient, and user-friendly as the tools their employees actually use.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">What is Secure Access Experiences?&nbsp;&nbsp;</h2>
Secure Access Experiences is the LastPass answer to this growing access management crisis &mdash; an evolving approach designed to bring together essential capabilities into one intuitive experience. It helps you control who has access to what, based on your own policies &mdash; not just passwords. Whether your team is using approved tools or ones you didn&rsquo;t even know about, you&rsquo;ll get the visibility and control you need, all in one easy-to-use solution.&nbsp;
With Secure Access Experiences, you will be able to:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Log in with ease: Securely manage how your team stores and uses passwords. Support for passkeys makes logging in even faster and safer.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Control who gets access: Make sure the right people have access to the right apps, systems, and data&mdash;nothing more, nothing less. It&rsquo;s easy to set up and adjust as your business grows.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">See what&rsquo;s happening: Know which apps your team is using, when, and how. Stay informed, spot issues early, and feel confident that everything&rsquo;s running smoothly.&nbsp;&nbsp;&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">Why do Secure Access Experiences matter?&nbsp;</h2>
As SaaS adoption grows and the lines between personal and professional tools blur, businesses need a smarter, simpler way to manage access &mdash; one that meets modern challenges head-on, without overwhelming teams or breaking the bank.&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Grows with your business: As your business adds more tools, people, and locations, LastPass makes it easy to keep everything secure without slowing you down.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Easy to manage, easier on your budget: Control access to all your tools from one place. Less hassle for you, and no need to invest in multiple systems.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Provides better protection, fewer headaches: Keep your business safe with strong, simple security&mdash;and make it easier to meet industry requirements along the way.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Simple for your team to use: When it&rsquo;s easy to use, your team actually uses it. That means stronger habits, less risk, and happier employees.&nbsp;</li>
</ul>
<h2 class="p4" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;">It starts with SaaS Monitoring and SaaS Protect.&nbsp;</h2>
You can&rsquo;t control what you can&rsquo;t see. The first capability in Secure Access Experiences was&nbsp;SaaS Monitoring. Now, SaaS Protect is available so that customers can take action on that visibility.&nbsp;&nbsp;&nbsp;
<img src="https://cdn.lputil.com/-/media/2b6fd9bba92346a8a0fcedeca39eed06.png?h=824&amp;w=1250" >
<p class="Paragraph SCXW34306727 BCX0" paraid="543943140" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{232}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">With SaaS Monitoring and SaaS Protect, business owners and IT admins can finally see what apps are being used across their organization, spot risky behavior, and make informed decisions about which apps to allow, restrict, or retire. helping them detect unapproved tools, spot Shadow IT and Shadow AI, and optimize application investments &mdash; all without the need to deploy extra agents, integrations, or complexity.
<p class="Paragraph SCXW34306727 BCX0" paraid="713470910" paraeid="{d0faa4d5-50fe-4037-b03d-c38b664a1e52}{238}" style="color: windowtext; background-color: transparent; margin-right: 0px; margin-bottom: 10.6667px; margin-left: 0px; padding: 0px;">The future of easier visibility and control is here. Start your Secure Access Experiences journey today.&nbsp;
<div class="button-container"><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>

Introducing Secure Access Experiences: Controlling the Chaos of Modern App Sprawl

Secure Access Experiences is the LastPass answer to this growing access management crisis.

Get LastPass Free

Create and store secure passwords for yourself, your team or business.

Why LastPass?

Remember fewer passwords and log in faster with our browser extension.

How LastPass works

LastPass zero-knowledge security model keeps your data private even from us.

Security Architecture

Compare LastPass competitors, plans, and features in one place

Compare LastPass

Overview

Password management

Save and autofill

Password generator

Password sharing

Passkeys

Dark web monitoring

Security dashboard

Key Features

Free LastPass Premium trial, no credit card required.

Free LastPass Business trial, no credit card required.

Let our experts help you find the right plan and successfully deploy LastPass.

Sync passwords across all devices, monitor password health, data breaches and much more.

Personal

Premium password management for family or group of 6 people.

Families

Personal Plans

Password vault

Save & autofill

Automatic device sync

Emergency access

Personal password sharing

FOR INDIVIDUALS

30-day free LastPass Premium trial, no credit card required.

30-day free LastPass Families trial, no credit card required.

Limited to 1 device type and basic password management features.

Designed for businesses of all sizes, from small startups to enterprises.

Business

Simplify secure access straight from the browser with more admin control.

Business Max

For single teams just getting started with password management.

Teams

Designed to keep your clients' credentials protected and private.

Business Plans

User management

SaaS Monitoring

SaaS Protect

Business sharing

Multifactor Authentication

Integrations

Single Sign-on

Identity management

For admins

Marketing teams

Legal teams

HR teams

Business leaders

IT admins

Solutions by role

Case studies

Webinars

Product demos

Events

Trust Center

Compliance Center

Security architecture

LastPass University

Resource Center

Pricing

Join the LastPass Partner Program to provide even more value to your customers.

Partner program overview

Managed Service Providers

Resellers

Cloud marketplaces

Technology Alliance Partners

LastPass Partner Program

Grow new revenue streams by meeting customer's security needs.

Looking for help or interested in becoming a LastPass partner? Get in touch with our partner team.

Connect with trusted LastPass Partners to support your security needs.

Partners

Self-service library of resources and guides for all LastPass products.

Support Center

Community forum

System status

Help

Personal support for all LastPass’ subscribed customers.

Support

Get LastPass free

Submit sales inquiry

Chat with sales

Request a demo

Find a partner

Contact sales

Log in

Your Small Business Guide to Agentic AI Identity & Access Management (2026)

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Agentic AI identity &amp; access management (agentic AI IAM) is about giving you control.&nbsp;It&rsquo;s&nbsp;about knowing what AI agents you have, what they can access, and what actions they can take on your behalf.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Because of their non-deterministic behavior (read &ldquo;unpredictability&rdquo;), AI agents&nbsp;can&rsquo;t&nbsp;just be classified as bot or machine identities.&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Traditional IAM falls short because its identity governance controls are too broad for autonomous agents, whose behavior can be manipulated in real-time.&nbsp; &nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">The Cloud Security Alliance&rsquo;s agentic AI IAM framework rests on 4 pillars, and&nbsp;they&rsquo;re&nbsp;critical whether you have 50 or 3,000 employees.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Are your employees connecting risky AI agents&nbsp;like&nbsp;Moltbot&nbsp;to Salesforce, QuickBooks, or Stripe? LastPass SaaS Monitoring shows you who has access to those&nbsp;business-critical&nbsp;apps, while tools like Permit.io&nbsp;let you&nbsp;enforce policies&nbsp;that prevent&nbsp;agents&nbsp;from executing unauthorized transactions.&nbsp;</li>
</ul>

Key takeaways: Agentic AI Identity & Access Management

FAQs: AI agent identity management

Agentic AI Identity & Access Management (Agentic AI IAM) involves tracking every AI tool - who approved it and what data it touches. 

Your Small Business Guide to Agentic AI Identity & Access Management (2026) 

It&rsquo;s the start of a new year, which means its time for two things: 1) People are (hopefully) sticking to their New Year&rsquo;s resolutions; and 2) We&rsquo;re heading into Data Privacy Week, an international effort led by the National Cybersecurity Alliance to help individuals and businesses take control of their data. In 2026, controlling your data increasingly comes down to controlling identity. Stolen credentials, password reuse, MFA fatigue, and social engineering are now the primary ways attackers get in&mdash;not by breaking systems, but by persuading people. That shift is also changing how cybercriminal groups operate. One of the clearest examples is a loose ecosystem known as Scattered Lapsus$ Hunters. This group targets a wide range of organizations and relies on compromised identities, help desk manipulation, and speed.
In the latest episode of The Phish Bowl moderated by Jordan Sher, cyber threat intelligence experts Mike Kosak and Stephanie Schneider connect these dots. We&rsquo;ll talk about data privacy and why identity sits at the center of it and what groups like Scattered Lapsus$ Hunters tell us about the evolution of social engineering. And with special guest Nate Howard from Flashpoint, we&rsquo;ll look at how threat intelligence, including visibility into the deep and dark web, helps defenders spot attacks before they land.
Whether your New Year&rsquo;s resolution was to get smarter on cybersecurity, or you&rsquo;re responsible for protecting users, systems, and data without a massive security team, we&rsquo;re glad you&rsquo;re starting off 2026 on the right foot with us. Let&rsquo;s get into it.
<h2>Trinity of Chaos: Scattered Lapsus$ Hunters</h2>
<a href="https://blog.lastpass.com/posts/social-engineering">Social engineering</a> is about manipulating the human element of security. It essentially preys on basic human behavior which makes it so effective. It&rsquo;s easier to hack people than it is to hack machines. Common tactics using this technique include phishing/vishing/smishing, baiting and tailgating, and pretexting. Social engineering will almost certainly continue to be prevalent to all organizations, big and small, in 2026. 
Scattered Lapsus$ Hunters is one of the most effective cybercriminal groups excelling at social engineering to get access to accounts or networks. They were behind several recent attacks last year, including Jaguar Land Rover that disrupted the larger automotive supply chain for months with a reported loss of &pound;485 million to &pound;559 million ($637M - $736M) for Q3 2025. The attack was estimated to have a broader impact on the UK economy, potentially reaching over $2 billion.&nbsp; 
It&rsquo;s an amalgamation of three different groups that have been kicking around (<a href="https://blog.lastpass.com/posts/blocking-unauthorized-access-webinar">Scattered Spider</a>, Lapsus$, and ShinyHunters) and are part of a community called The Com where they share social engineering techniques. We can follow some of these conversations they&rsquo;re having on DDW to monitor the group&rsquo;s interests, capabilities, and infer where (which organizations or sectors) and how (with what tactics) they might strike next. 
<h2>Interview with Nate from Flashpoint</h2>
Our special guest is Nate Howard, Flashpoint&rsquo;s Senior Manager on Customer Success Team, joining us to talk about his perspectives on the deep dark web (DDW), <a href="https://blog.lastpass.com/posts/ai-supercharges-credential-harvesting">how artificial intelligence (AI) will shape cyber threats</a>, and real-world examples of how having access to intelligence can allow organizations to take proactive measures against threats. 
With roots in network engineering and a career that grew into security intelligence and digital offensive security, Nate has spent years countering threats from both sides of the wire. His deep experience across the deep and dark web provides a firsthand understanding of adversary ecosystems, emerging attack techniques, and how defenders can stay ahead. At Flashpoint, he helps support efforts that can be broken down into three pillars: 1) collecting data from across the DDW, 2) creating quality, finished intelligence products, 3) and providing services that play directly into making intelligence actionable for customers to be proactive and drive success in their own organizations. 
People see the DDW as a mysterious place, but Nate explains that it&rsquo;s actually closer to where we&rsquo;re normally operating than you might think. It&rsquo;s essentially made up of forums, blogs, and chat services that are relatively easy to find and access on a different internet via Tor. Threat actors like Scattered Lapsus$ Hunters are operating somewhat out in the open on the DDW, which gives us an advantage to monitor them (i.e., their personalities, TTPs, etc.), understand context and analysis around data, and respond proactively. 
Talking about the types of threats organizations should be most concerned with, Nate explained why agentic AI threats will continue to pose a significant threat. They allow threat actors who were not capable of certain attacks to now be able to do so and commodify those threats. AI will impact various attack types, particularly phishing and other social engineering tactics. AI will allow attackers to broaden the scale and scope of their attacks. <a href="https://blog.lastpass.com/posts/joint-report-lastpass-guidepoint-security-infostealers">Infostealers</a> and CVE volatility are other threats organizations should pay attention to, according to Nate. 
<h2>Actioning intelligence in real life: mitigating exposed employee credentials</h2>
To really drive home the point about how valuable technical data and real time access to the human side of security can be, and what you can do when you have access to it, Nate talked about a real-world example he says Flashpoint frequently delivers: mitigating exposed credentials. Due to Flashpoint&rsquo;s broad access to stealer logs, forums, and chat services, they&rsquo;re able to find employee credentials that are out there and have ability to monitor and alert an affected organization if employee credentials are compromised. This rapid alerting enables companies to act quickly to prevent data loss. 
Infostealers are frequently behind breaches, silently grabbing credentials and other sensitive information and selling or posting them online to be used in other attacks. For instance, an infostealer was behind the <a href="https://blog.lastpass.com/posts/snowflake-recap">Snowflake breach</a> in 2024, allowing attackers to take leaked credentials and login to accounts not protected with multi-factor authentication (MFA). 
<h2>Listen to the full episode&nbsp;&nbsp;</h2>
Catch the full episode and additional resources for more cyber threat insights from the LastPass Threat Intelligence, Mitigations, and Escalations (TIME) Team. 
<ul>
 <li>Listen to the full episode of The Phish Bowl wherever you get your podcasts:&nbsp;&nbsp;
 <ul>
 <li><a rel="noopener noreferrer" href="https://www.youtube.com/@LastPass/podcasts" target="_blank">YouTube</a></li>
 <li><a rel="noopener noreferrer" href="https://open.spotify.com/show/1TQiFDk9acmkfp1sTFN1yX" target="_blank">Spotify</a></li>
 <li><a rel="noopener noreferrer" href="https://podcasts.apple.com/podcast/id1828511920" target="_blank">Apple</a></li>
 </ul>
 </li>
 <li>Subscribe for monthly threat intel deep dives. </li>
 <li>Access LastPass's <a href="https://info.lastpass.com/threat-reports">Regional Report</a> for detailed analysis of recent APAC trends and activity. </li>
 <li>Check out the <a rel="noopener noreferrer" href="https://blog.lastpass.com/categories/threat-intel" target="_blank">LastPass Labs blog</a> for more insights.&nbsp;</li>
</ul>
See you back in February to talk about Europe cyber threats! 
&nbsp;

The Phish Bowl Explores How Identity is Under Attack, Scattered LAPSUS$ Hunters, and Cybercrime Trends

This article recaps the January 2026 episode of The Phish Bowl, a podcast featuring cyber threat intelligence experts diving deep into relevant cybersecurity topics. This episode covers protecting identity as a security fundamental, Scattered Lapsus$ Hunters and their social engineering tactics, and cybercrime trends. 

What is AI agent authentication, and why does your small business need it in 2026? 

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">AI agents are already in your&nbsp;business, and they need their own authentication solution.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">FIDO2 MFA&nbsp;creates an extra barrier&nbsp;unauthorized&nbsp;AI agents&nbsp;can&rsquo;t&nbsp;bypass.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">The biggest threats&nbsp;aren&rsquo;t&nbsp;external attackers;&nbsp;they&rsquo;re&nbsp;overprivileged agents and Shadow AI.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Attackers are targeting AI agents through prompt injection, AI model poisoning, credential theft, and hijacked agent-to-agent communications.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">With LastPass SaaS Monitoring, your business can rein in Shadow AI without a massive IT budget.&nbsp;</li>
</ul>

Key takeaways: Agent authentication

FAQs: Agent authentication

With LastPass SaaS Monitoring, your business can rein in Shadow AI without a massive IT budget. 

What Is AI Agent Authentication, and Why Does Your Small Business Need It in 2026? 

22 January 2026 UPDATE:&nbsp;
The&nbsp;suspected threat&nbsp;actors behind this campaign have&nbsp;sent another wave of phishing emails using similar tactics. The body of the email&nbsp;remains&nbsp;the same, but the&nbsp;links have been changed following&nbsp;LastPass&rsquo;&nbsp;disruption of their&nbsp;initial&nbsp;infrastructure&nbsp;in conjunction with&nbsp;our partners.&nbsp;We&nbsp;also found other domains registered,&nbsp;likely by&nbsp;this&nbsp;threat&nbsp;actor&nbsp;given&nbsp;the use of&nbsp;similar procedures, that&nbsp;indicate&nbsp;a broader infrastructure that may be used&nbsp;or have been used&nbsp;in&nbsp;this and/or&nbsp;other&nbsp;phishing campaigns. We recommend blocking these domains/URLs now.&nbsp;&nbsp;
Below please find the updated&nbsp;IOCs:&nbsp;
Sender&nbsp;Emails:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">All emails are formatted as&nbsp;support@lastpass.[SERIES OF TWO TO FIVE RANDOM CHARACTERS]&nbsp;</li>
</ul>
URLs:&nbsp;
<ol>
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">systems-resources.s3.eu-west-3.amazonaws[.]com/sSvLaIvIEm5iMal&nbsp;</li>
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">security-lastpass.com&nbsp;</li>
</ol>
Associated IPs:&nbsp;&nbsp;
<ul class="ul3" style="color: #000000; list-style-type: square;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">172.67.157[.]54&nbsp;</li>
</ul>
<ul class="ul3" style="color: #000000; list-style-type: square;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">104.21.73[.]30&nbsp;</li>
</ul>
<ul class="ul3" style="color: #000000; list-style-type: square;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">109.205.213[.]50&nbsp;</li>
</ul>
Note: This IP is also associated with the following&nbsp;brand impersonation sites that may be used for illicit purposes:&nbsp;&nbsp;
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Emergency-access-lastpass[.]com&nbsp;</li>
</ul>
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Settings-lastpass[.]com&nbsp;</li>
</ul>
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Setting-lastpass[.]com&nbsp;</li>
</ul>
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Backup-lastpass[.]com&nbsp;</li>
</ul>
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Lastpass-backups[.]com&nbsp;</li>
</ul>
Subject Lines:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">LastPass Server Maintenance: Backup Recommended&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">LastPass Maintenance Scheduled: Here's What You Need to Do&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Critical: Please Backup Your LastPass Vault Before Maintenance&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">LastPass Infrastructure Update: Secure Your Vault Now&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">LastPass Maintenance: Secure Your Data Today&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Important: LastPass Maintenance &amp; Your Vault Security&nbsp;</li>
</ul>
While this is always a best practice,&nbsp;we recommend you&nbsp;confirm any email claiming to be from LastPass&nbsp;are&nbsp;coming from legitimate LastPass email domains&nbsp;as this campaign is ongoing. The domains are listed&nbsp;below&nbsp;and more information can be found here: <a href="https://support.lastpass.com/s/document-item?language=en_US&amp;bundleId=lastpass&amp;topicId=LastPass/phishing_report.html&amp;_LANG=enus">Report a phishing email to LastPass</a>&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">@lastpass.com&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">@sendgrid.com&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">@m.lastpass.com&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">@t.lastpass.com@ar.lastpass.com&nbsp;</li>
</ul>
Again, if you are ever unsure whether a LastPass branded email is legitimate,&nbsp;submit&nbsp;it to&nbsp;<a href="mailto:abuse@lastpass.com">abuse@lastpass.com</a>.&nbsp;
Original Post:&nbsp;
LastPass&nbsp;Threat Intelligence, Mitigation, and Escalation (TIME)&nbsp;would like to alert our customers&nbsp;to&nbsp;an&nbsp;active&nbsp;phishing campaign that&nbsp;began on or around January 19, 2026. These&nbsp;phishing emails are&nbsp;being sent&nbsp;from&nbsp;several&nbsp;email addresses&nbsp;with&nbsp;various&nbsp;subject lines&nbsp;claiming&nbsp;that&nbsp;LastPass is about&nbsp;to&nbsp;conduct maintenance and urging users to&nbsp;backup&nbsp;their vaults&nbsp;in the next 24 hours. The known list of email addresses&nbsp;and subject lines can be found below.&nbsp;&nbsp;&nbsp;
Please be advised&nbsp;that&nbsp;LastPass&nbsp;is&nbsp;NOT&nbsp;asking customers to&nbsp;backup&nbsp;their vaults in the next 24 hours; rather,&nbsp;this is an attempt on the part of&nbsp;a&nbsp;malicious actor to generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails.&nbsp;&nbsp;
The below image displays the body of&nbsp;an example&nbsp;email&nbsp;we have&nbsp;observed&nbsp;with&nbsp;a&nbsp;link purporting to take potential victims to a&nbsp;site that will&nbsp;supposedly allow&nbsp;recipients to create backups of their vault. Instead,&nbsp;this link&nbsp;will&nbsp;actually&nbsp;direct&nbsp;victims to a phishing site hosted at&nbsp;&ldquo;group-content-gen2.s3.eu-west-3.amazonaws[.]com/5yaVgx51ZzGf&rdquo;&nbsp;which then redirects to &ldquo;mail-lastpass[.]com.&rdquo;&nbsp;The timing of the campaign, which fell&nbsp;over a holiday weekend in the United States, is a common tactic among threat actors&nbsp;seeking&nbsp;to&nbsp;take advantage of reduced staffing under the assumption it will&nbsp;postpone detection and draw out response time.&nbsp;&nbsp;
Body of Current Phishing Email as of January 20, 2026
<img src="https://www.lastpass.com/-/media/d5b188257135407989134d0c48c84c7e.png" >
Please remember that no one at LastPass will&nbsp;ever ask for your master password.&nbsp;Rest assured,&nbsp;we are&nbsp;working&nbsp;with our third-party partners&nbsp;to have this domain taken down&nbsp;as soon as possible.&nbsp;In the meantime,&nbsp;please&nbsp;take the&nbsp;appropriate precautions&nbsp;and,&nbsp;as always, if you&nbsp;are ever unsure whether&nbsp;a&nbsp;LastPass branded&nbsp;email is&nbsp;legitimate,&nbsp; submit&nbsp;it to&nbsp;<a href="mailto:abuse@lastpass.com">abuse@lastpass.com</a>.&nbsp;We would like to thank our customers who have already&nbsp;submitted&nbsp;this email for their vigilance and&nbsp;commitment to keeping our community secure.&nbsp;&nbsp;
Malicious URLs and associated IPs:&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">&ldquo;group-content-gen2.s3.eu-west-3.amazonaws[.]com/5yaVgx51ZzGf&rdquo;&nbsp;</li>
</ul>
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li7" style="color: #211f1f; margin: 0px;">Serving IP address at time of publication:&nbsp;52.95.155[.]90&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">&ldquo;mail-lastpass[.]com&rdquo;&nbsp;</li>
</ul>
<ul class="ul2" style="color: #000000; list-style-type: circle;">
 <li class="li7" style="color: #211f1f; margin: 0px;">Associated&nbsp;IP addresses&nbsp;at time of publication:&nbsp;&nbsp;</li>
</ul>
<ul class="ul3" style="color: #000000; list-style-type: square;">
 <li class="li7" style="color: #211f1f; margin: 0px;">104.21.86[.]78&nbsp;</li>
</ul>
<ul class="ul3" style="color: #000000; list-style-type: square;">
 <li class="li7" style="color: #211f1f; margin: 0px;">172.67.216[.]232&nbsp;</li>
</ul>
<ul class="ul3" style="color: #000000; list-style-type: square;">
 <li class="li7" style="color: #211f1f; margin: 0px;">188.114.97[.]3 &nbsp;</li>
</ul>
Header information:&nbsp;
From:&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">support@sr22vegas[.]com&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">support@lastpass[.]server8&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">support@lastpass[.]server7&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">support@lastpass[.]server3&nbsp;</li>
</ul>
Associated&nbsp;IPs:&nbsp;&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">192.168.16[.]19&nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">172.23.182.202&nbsp;</li>
</ul>
Subjects:&nbsp;
<ul class="ul1" style="color: #000000;">
 <li class="li7" style="color: #211f1f; margin: 0px;">LastPass Infrastructure Update: Secure Your Vault Now&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Your Data, Your Protection: Create a Backup Before Maintenance&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Don't&nbsp;Miss Out: Backup Your Vault Before Maintenance&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Important: LastPass Maintenance &amp; Your Vault Security&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li8" style="color: rgba(0, 0, 0, 0.85); background-color: #ffffff; margin: 0px;">Protect Your Passwords: Backup Your Vault (24-Hour Window)&nbsp;</li>
</ul>

January 2026 Phishing Campaign Targeting LastPass Customers [UPDATE] 

Another wave of phishing emails using similar tactics has been sent from the same threat actors on January 19. 

January 2026 Phishing Campaign Targeting LastPass Customers [UPDATE]

What Are Zero-Day Exploits, and Why Are They So Dangerous in 2026? 

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">&bull; A zero-day exploit is specially crafted&nbsp;code&nbsp;or a technique&nbsp;an&nbsp;attacker uses to weaponize a discovered vulnerability in a target system.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Zero-day exploits are dangerous because they hit before anyone knows a flaw exists, giving attackers an opportunity&nbsp;to&nbsp;steal&nbsp;passwords, drain accounts, and&nbsp;exfiltrate&nbsp;trade secrets.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">CVE-2021-30116&nbsp;and CVE-2025-6554 are prime examples of zero-day exploits in action.&nbsp; &nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">There are seven (7) stages in a zero-day&nbsp;exploit&nbsp;lifecycle;&nbsp;#6 is where lack of visibility complicates your response to an attack.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">The biggest struggle for many businesses&nbsp;isn&rsquo;t&nbsp;the zero-day itself.&nbsp;It&rsquo;s&nbsp;lacking clear visibility into&nbsp;SaaS usage, making it difficult to assess exposure or respond effectively.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li3" style="margin: 0px;">With LastPass SaaS monitoring, you get full SaaS visibility and centralized identity&nbsp;controls, which lets you&nbsp;quickly verify zero-day affected apps, rotate credentials, and secure access as soon as the vendor releases a patch.&nbsp;&nbsp;</li>
</ul>

Key takeaways: Zero-day exploits

FAQs: Zero-day exploit

Learn about zero-day exploits and how with LastPass SaaS monitoring, you get full SaaS visibility and centralized identity controls, which lets you quickly verify zero-day affected apps,

LastPass Threat Intelligence, Mitigation, and Escalation (TIME) team would like to alert our customers to an active phishing campaign that began on or around January 19, 2026. These phishing emails are being sent from several email addresses with various subject lines claiming that LastPass is about to conduct maintenance and urging users to backup their vaults in the next 24 hours. The known list of email addresses and subject lines can be found below.
Please be advised that LastPass is NOT asking customers to backup their vaults in the next 24 hours; rather, this is an attempt on the part of a malicious actor to generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails.
The below image displays the body of an example email we have observed with a link purporting to take potential victims to a site that will supposedly allow recipients to create backups of their vault. Instead, this link will actually direct victims to a phishing site hosted at &ldquo;group-content-gen2.s3.eu-west-3.amazonaws[.]com/5yaVgx51ZzGf&rdquo; which then redirects to &ldquo;mail-lastpass[.]com.&rdquo; The timing of the campaign, which fell over a holiday weekend in the United States, is a common tactic among threat actors seeking to take advantage of reduced staffing under the assumption it will postpone detection and draw out response time.

Body of Current Phishing Email as of January 20, 2026
<img src="https://www.lastpass.com/-/media/4850cdc5225c44ab8a5b8cd1afc79962.png" >
Please remember that no one at LastPass will ever ask for your master password. Rest assured, we are working with our third-party partners to have this domain taken down as soon as possible. In the meantime, please take the appropriate precautions and, as always, if you are ever unsure whether a LastPass branded email is legitimate, submit it to <a href="mailto:">abuse@lastpass.com</a>. We would like to thank our customers who have already submitted this email for their vigilance and commitment to keeping our community secure. 
Malicious URLs and associated IPs:
<ul>
 <li>&ldquo;group-content-gen2.s3.eu-west-3.amazonaws[.]com/5yaVgx51ZzGf&rdquo; 
 <ul>
 <li>Serving IP address at time of publication: 52.95.155[.]90 </li>
 </ul>
 </li>
 <li>&ldquo;mail-lastpass[.]com&rdquo; 
 <ul>
 <li>Associated IP addresses at time of publication: 
 <ul>
 <li>104.21.86[.]78</li>
 <li>172.67.216[.]232</li>
 <li>188.114.97[.]3</li>
 </ul>
 </li>
 </ul>
 </li>
</ul>
Header information:
From:
<ul>
 <li>support@sr22vegas[.]com</li>
 <li>support@lastpass[.]server8</li>
 <li>support@lastpass[.]server7</li>
 <li>support@lastpass[.]server3</li>
</ul>
Associated IPs:
<ul>
 <li>192.168.16[.]19</li>
 <li>172.23.182.202</li>
</ul>
Subjects:
<ul>
 <li>LastPass Infrastructure Update: Secure Your Vault Now</li>
 <li>Your Data, Your Protection: Create a Backup Before Maintenance</li>
 <li>Don't Miss Out: Backup Your Vault Before Maintenance</li>
 <li>Important: LastPass Maintenance &amp; Your Vault Security</li>
 <li>Protect Your Passwords: Backup Your Vault (24-Hour Window)</li>
</ul>

New Phishing Scam Targeting LastPass Users - The LastPass Blog

LastPass warns customers of a new phishing campaign urging fake vault backups. Learn how the scam works and how to protect your account.

New Phishing Campaign Targeting LastPass Customers

What is server side request forgery? 

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">SSRF allows attackers to trick your server into&nbsp;fetching resources from your internal IP&nbsp;addresses&nbsp;or cloud metadata endpoints.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">The key difference between CSRF&nbsp;(cross site request forgery)&nbsp;and SSRF&nbsp;(server side&nbsp;request forgery)&nbsp;is that they target completely different victims.&nbsp;&nbsp;While CSRF targets your customers, SSRF attacks your&nbsp;business.&nbsp; &nbsp;&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">SSRF attacks have surged 452% because they allow attackers to bypass&nbsp;your&nbsp;edge or perimeter firewalls.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">OWASP battle-tested libraries can unmask the hex, octal, and mixed encodings that attackers use to bypass your IP validation filters.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Do&nbsp;over-permissioned&nbsp;internal services and&nbsp;admin/dev logins&nbsp;keep you up at night?&nbsp;LastPass Business Max complements&nbsp;metadata access&nbsp;controls&nbsp;to&nbsp;keep your business safe.&nbsp;</li>
</ul>

Key takeaways: Server-side request forgery 

FAQs: Server side request forgery

SSRF allows attackers to trick your server into fetching resources from your cloud metadata endpoints. LastPass Business Max complements metadata access controls to keep your business safe.

SSRF Attacks Are Up 452%: Here’s Your 5-Minute Business-Friendly SSRF Prevention Guide

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Cross site request forgery (CSRF) is an attack that exploits the trust your app has in authenticated users.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Imagine your site processing transactions your customers never approved:&nbsp;A&nbsp;CSRF&nbsp;attack&nbsp;is&nbsp;deadly for business.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">There are three (3) conditions that make a CSRF attack more likely, and #3 takes advantage of a universal habit.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Talking with your dev team about CSRF means&nbsp;starting&nbsp;a discussion about the smart protections already in place.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="margin: 0px;">Fighting back against CSRF&nbsp;involves&nbsp;properly configured&nbsp;SameSite&nbsp;settings,&nbsp;use of&nbsp;CSRF tokens,&nbsp;Origin/Referer&nbsp;validation, strong identity controls&nbsp;with LastPass, and prohibiting GET state-changing requests.&nbsp;</li>
</ul>

Key takeaways: Cross site request forgery

FAQs: Cross site request forgery

<div id="calloutcontent1">&nbsp;</div>
Cross site request forgery&nbsp;(C[..]

What Is Cross Site Request Forgery? The 5-Minute CSRF Guide for Business Owners

Strengthening Cyber Resilience Through Partnership: Insights from Australia and New Zealand

LastPass Senior Threat Intelligence Analyst Mike Kosak reflects on his recent travel to Australia and New Zealand to meet with customers and Australian and New Zealand government representatives. One of the common themes that arose consistently across my conversations was the importance of partnerships within cybersecurity. 

online scams 

<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">&ldquo;But they seemed&nbsp;so real&rdquo; puts you in danger. Always verify before you&nbsp;trust.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Real businesses or federal agencies will never demand payment in&nbsp;gift cards, cryptocurrency, or wire transfers.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">You&nbsp;aren&rsquo;t&nbsp;the target because&nbsp;you&rsquo;re&nbsp;gullible.&nbsp;You&rsquo;re&nbsp;the target because&nbsp;you&rsquo;re&nbsp;human.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Scammers sell feelings, urgency, and FOMO.&nbsp;Unrealistically &ldquo;perfect&rdquo;&nbsp;promises are warning signs&nbsp;(guaranteed riches, instant cures). Trust your gut and walk away.&nbsp;</li>
</ul>
<ul class="ul1" style="color: #000000;">
 <li class="li1" style="color: rgba(0, 0, 0, 0.85); margin: 0px;">Your memory may play tricks on you.&nbsp;But your&nbsp;&ldquo;safe words&rdquo; and sensitive info&nbsp;are&nbsp;secure&nbsp;and accessible with&nbsp;LastPass.&nbsp;</li>
</ul>

Key takeaways: Online scams

FAQs: Online scams

20 must-know online scams and your 2026 defense guide. 

Online Scam Alert: 20 Must-Know Online Scams + Your 2026 Defense Guide 

<div id="calloutcontent1">&nbsp;</div>
Season&rsquo;s greetings from all of us here at LastPass and The Phish Bowl. We have a great new episode and corresponding regional report for you all on updates to the North American threat landscape. But first, as 2025 comes to an end, I wanted to pause for just a second and thank my amazing co-host Mike Kosak, our listeners, and recognize the entire team behind the scenes that&rsquo;s made this podcast possible. As we wrap up 2025, it&rsquo;s amazing to look back and see what we&rsquo;re building together over the last six episodes. A community of curious minds who want to understand what&rsquo;s really driving cyber threats in our world. We can&rsquo;t wait to see what 2026 has in store. 
So, without further ado, let&rsquo;s dive into the latest episode of The Phish Bowl together where we cover cyber threat analysis of common holiday scams and threat predictions for next year. We&rsquo;re joined by our fellow LastPass teammates Jordan Sher, our new podcast co-host and Vice President of Marketing, and Alex Cox, Director of the Threat Intelligence, Mitigations, and Escalations (TIME) team. 

<iframe width="560" height="315" src="https://www.youtube.com/embed/A_CF0vrH8TI?si=ofnCLdsRfrez4qwo" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen=""></iframe>

<h2>What types of holiday scams should you look out for? </h2>
Holidays are prime for cyber crooks taking advantage of the end of year online shopping rush. It&rsquo;s that time of year when our inboxes and text messages are blown up by advertisements, promotional deals, and delivery notifications for the slew of packages to put under the tree. That makes it more likely for people to click on a lot of stuff they wouldn&rsquo;t normally click on. Cybercriminals take advantage of this and try to blend in as legitimate emails. Mobile targeting has become more common too, with more<a href="https://blog.lastpass.com/posts/smishing-vs-vishing"> smishing (text phishing) and vishing (voice phishing)</a> attacks, as people spend more time on their phones. These scams frequently promise to offer promotions that seem too good to be true (because they are) and try to pressure you into quickly taking some kind of action, which is a common tactic and dead giveaway that this is a scam. Common types of <a href="https://www.rd.com/article/holiday-shopping-scams-2025/">holiday scams</a> include the following: 
<ul>
 <li>Delivery notifications &ndash; With lots of packages being delivered this time of year, there are more fake notifications via text pretending to be package delivery alerts requiring some type of action, such as paying a tariff, to receive the alleged package. </li>
 <li>Unpaid tolls &ndash; Toll collection scams were already prevalent this year and will likely increase during holiday travel periods as more people are traveling on the road and therefore more likely to believe the scam, oftentimes handing over credentials or money. </li>
 <li>Gift cards &ndash; Everybody gets gift cards this time of year, and cybercriminals have always taken advantage of that. Scammers may advertise discounted gift cards that are unusable in exchange for victims&rsquo; payment information. </li>
</ul>
Consider this as your friendly neighborhood reminder not to click on any link that you don&rsquo;t recognize and watch out for suspicious calls, text, and emails to stay safe online this holiday season.
<h2>North America regional threat report</h2>
The overall trend in cybersecurity indicates a continuously challenging environment for North American entities. The United States continues to be the primary target within the region due to its significant attack surface, with Canada also experiencing a high volume of activity. Financially motivated activities, cyberespionage, information operations, and hacktivism are expected to remain key threats, with new trends emerging in the exploitation of AI and the targeting of critical infrastructure and supply chains. Check out <a href="https://info.lastpass.com/threat-reports">the latest North American threat report</a> for a deeper dive on the latest regional trends. 
<h2>2026 cybersecurity threat analysis: identity, critical infrastructure, supply chain, and AI risks</h2>
Seeing into the future isn&rsquo;t as complicated as trying to read a crystal ball when we have our fingers on the pulse. Monitoring threat activity and identifying trends this year helps us see and prepare for the threats that are coming down the pipeline. Looking ahead at 2026, these are some of the key trends we are anticipating. 
Identity in the crosshairs&nbsp;
It seems like most cyber threat activity these days comes back to compromising identities, often in the form of stolen credentials. Looking ahead to 2026, we expect to see attackers continue to aggressively <a href="https://lastpassinc-my.sharepoint.com/personal/stephanie_keinz_lastpass_com/Documents/Articles/Phish%20Bowl%20podcast%20summary/o%09https:/www.lastpass.com/resources/learning/identity-theft-protection-begins-with-identity-management">target identities</a> to enable attacks. They will likely adapt their methods as passkeys are increasingly adopted to exploit related weaknesses (like finding weaknesses in account recovery and reset requests instead of stealing passwords themselves) and focus more on stealing browser cookies as MFA is increasingly rolled out (to inject themselves into active sessions rather than trying to steal or intercept MFA codes). Artificial intelligence (AI) will amplify this threat. For instance, <a href="https://blog.lastpass.com/posts/generative-ai-and-phishing">AI-powered phishing</a>&nbsp;scams combined with the use of leaked credentials led to $262 million in losses in 2025. 
Critical infrastructure under threat
Critical infrastructure is a common target for cybercriminals, nation-state actors, and hacktivists, and this threat has been increasing over time. Concerning threats to the private sector, some companies may have secondary or tertiary connections with critical infrastructure that they aren&rsquo;t aware of and could face business continuity disruptions if that critical infrastructure goes down. Notably, the upcoming elections in the United States are coming up in 2026, and there&rsquo;s a real chance that election infrastructure will be targeted. 
Reimagined supply chain attacks
Attackers have increasingly targeted supply chains because they can conduct widespread attacks using relatively little effort. In 2026, we expect attackers will increasingly focus on open-source supply chain compromise, like the recent NPM attacks, like the recent wave of attacks compromising NPM packages with the Shai-Hulud worm. 
The AI of it all
AI will make hackers&rsquo; jobs easier, allowing them to conduct attacks faster, at bigger scale, and just generally better.
<h2>Listen to the full episode&nbsp;&nbsp;</h2>
Catch the full episode and additional resources for more cyber threat insights from the LastPass Threat Intelligence, Mitigations, and Escalations (TIME) Team. 
<ul>
 <li>Listen to the full episode of The Phish Bowl wherever you get your podcasts:&nbsp;&nbsp;
 <ul>
 <li><a rel="noopener noreferrer" href="https://www.youtube.com/@LastPass/podcasts" target="_blank">YouTube</a>&nbsp;</li>
 <li><a rel="noopener noreferrer" href="https://open.spotify.com/show/1TQiFDk9acmkfp1sTFN1yX" target="_blank">Spotify</a>&nbsp;</li>
 <li><a rel="noopener noreferrer" href="https://podcasts.apple.com/podcast/id1828511920" target="_blank">Apple</a>&nbsp;</li>
 </ul>
 </li>
 <li>Subscribe for monthly threat intel deep dives.&nbsp;</li>
 <li>Access LastPass's <a href="https://info.lastpass.com/threat-reports">Regional Report</a> for detailed analysis of recent North American trends and activity.&nbsp;</li>
 <li>Check out the <a rel="noopener noreferrer" href="https://blog.lastpass.com/categories/threat-intel" target="_blank">LastPass Threat Intel blog</a> for more insights.&nbsp;</li>
</ul>
Looking forward to seeing you all in the New Year to talk about Asia-Pacific cyber threats!

The Phish Bowl explores what’s inside the 2026 cybersecurity crystal ball: identity, AI & new threats

<ul>
 <li>Online scams are common during the holidays. Cybercriminals want to take advantage at a time when folks have their guards down and are more likely to click on holiday related scams.  </li>
 <li>Some of our key threat predictions for 2026 include identity compromise, critical infrastructure, and supply chain attacks.  </li>
 <li>Identity compromise is one of the largest threats enabling data breaches, ransomware attacks, and other malicious cyber activities. This includes both human and non-human identities like machines and applications.  </li>
 <li>Threat actors are increasingly targeting critical infrastructure which can have widespread disruptions on the private sector via operational dependencies.  </li>
 <li>Supply chain attacks are a golden ticket for hackers, offering a big return on investment by enabling widespread impact to upstream or downstream victims via initially compromising a single source.   </li>

</ul>

Key takeaways: Holiday scams and 2026 threat predictions

<div id="calloutcontent1">&nbsp;</div>
Season&rsquo;s greetings from all of us here at LastPass and The Phish Bowl. We have a great new episode and corresponding regional report for you al[..]

One chapter in the saga of infostealer malware has ended&mdash;at least for now&mdash;after a global law enforcement takedown of Lumma Stealer in mid-May. US, European, and Japanese authorities, with the help of tech companies including Microsoft and Cloudflare, took down, suspended, and blocked approximately 2,300 malicious domains that made up part of the infostealer&rsquo;s backbone. The FBI also seized domains that served as login panels allowing other criminals to access and use the infostealer. Although, this seizure is intended to effectively prevent criminals from being able to access Lumma to compromise computers and steal data, the overall stealer threat will remain prevalent for the foreseeable future. 
(Interested in learning more about the infostealer threat outlook? Read the LastPass TIME team&rsquo;s threat predictions and analysis on <a href="https://blog.lastpass.com/posts/2025-cybersecurity-trends">what direction infostealers and other threats are heading</a>.) 
<h2>What is Lumma?</h2>
 
Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022. Since its initial release, Lumma&rsquo;s developers have released multiple upgraded versions of the software. Before the malware-as-a-service (MaaS) platform was dismantled, the FBI linked Lumma to around <a href="https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted">10 million infections</a> globally. Lumma&rsquo;s follow-on attacks involving stealing credentials, cryptocurrency data, and credit card information have resulted in an estimated <a href="https://cyberscoop.com/lumma-infostealer-widespread-victims/">$36.5 million USD</a> in credit card theft in 2023. The malware hit individuals and a wide range of industries, including Fortune 500 companies, airlines, universities, banks, and hospitals. 
What makes this stealer particularly effective is that it continues to evolve to bypass security layers even as defenders are responding to the threat. On top of grabbing browser-stored passwords and cookies, it&rsquo;s also capable of extracting autofill data, email credentials, File Transfer Protocol (FTP) data, and two-factor authentication tokens and backup codes. Using its MaaS platform, its creators sold access to the malware on multiple underground markets and platforms like Telegram. 
<h2>What comes next?</h2>
 
This takedown is a major win for law enforcement and will help disrupt the initial access broker ecosystem in the near term. However, this is an ecosystem that has demonstrated its resilience again and again. The number of existing infostealer families, the open access to numerous source codes of previous infostealers, and the constant demand create a lucrative environment with very low barriers to entry. Given the resiliency of this market, other infostealer will likely quickly step in and fill in the gaps left after the Lumma takedown. 
A similar pattern previously played out with other similar takedowns. On October 28, 2024, Operation Magnus disrupted the RedLine and META infostealers. RedLine was a significant stealer last year up until the takedown, after which Lumma grew in popularity and took over a portion of the market share previously held by RedLine. Redline infected 9.9 million hosts, or 43% of all infostealer infections observed by Flashpoint in 2024. The next four most-prolific infostealers in 2024, including RisePro, SteaC, Lumma Stealer, and Meta Stealer, infected a <a href="https://cyberscoop.com/infostealers-cybercrime-surged-2024-flashpoint/">combined 7 million hosts</a>. 
We expect to see something similar following the Lumma Stealer takedown operation. The disruption effect following takedown is real, but there are still some new infections and logs for sale that were likely stolen before the infrastructure was taken down. Additionally, just because Lumma&rsquo;s infrastructure was dismantled, a lot of the data it stole likely continues to live on the dark web&mdash;thanks to the cybercriminal ecosystem that resells this information. Additionally, <a href="https://blog.checkpoint.com/security/lumma-infostealer-down-but-not-out/">CheckPoint</a> reported Lumma&rsquo;s developers are already trying to rebuild and restart their operations, which may or may not be successful.&nbsp;As SpyCloud&rsquo;s <a href="https://www.linkedin.com/posts/thilligoss_lummatakedown-lummareallynowork-stealc-activity-7332888157480198146-u94p">Trevor Hilligoss shared</a>, daily new Lumma infections have trended downward following the takedown but not as much as expected. Continued monitoring will be necessary to determine the takedown&rsquo;s impact. 
Long-standing groups such as Vidar and Stealc are good examples of this, but other newer families, such as Acreed, will also be well positioned to increase their market share. <a href="https://www.bleepingcomputer.com/news/security/russian-market-emerges-as-a-go-to-shop-for-stolen-credentials/">ReliaQuests</a> already reported Acreed is rapidly gaining traction following the Lumma takedown. <a href="https://webz.io/dwp/acreed-infostealer-everything-we-know-so-far/">Over 4,000 logs</a> stolen by Acreed were reportedly uploaded to the Russian Market within its first week of operations.&nbsp;Nexus has also gained some traction over the last week in Lumma&rsquo;s absence. Further, former affiliates and/or administrators associated with Lumma itself may split off to create their own offerings.

<img src="https://cdn.lputil.com/-/media/ffef2d4ef9d544babc2169a6d0274059.jpg?h=310&amp;w=624" >&nbsp;
Daily new LummaC2 infections (Source: Trevor Hilligoss)
<h2>How to protect yourself against infostealers</h2>
The threat from infostealers will remain very real for the foreseeable future and continue to adapt. Oftentimes, stealers are used in indiscriminate campaigns. Additionally, the sheer volume of data that has been dumped on the internet is immense. That means anyone is fair game and should take action to protect themselves following that assumption that they could be targeted. 
<ul>
 <li>Use strong, unique passwords for every account. This will prevent credential stuffing attacks, which is a common tactic where threat actors insert stolen usernames and passwords. That way, if one password is exposed, it won&rsquo;t give access to all your other accounts where you reuse the same password. Also, consider using a password manager to securely and conveniently store them.</li>
 <li>Enable MFA on your accounts. While this measure isn&rsquo;t failproof on its own, it adds an additional layer of defense and makes you a harder target.</li>
 <li>Be on guard for phishing attempts. Infostealers often spread through phishing emails and malicious downloads. </li>
 <li>Check HaveIBeenPwned to monitor potential exposure if you&rsquo;re worried you may have been infected by an infostealer. </li>
</ul>

What the Lumma stealer takedown means for the infostealer market and your personal data

Lumma Stealer, also known as LummaC2, dominated the expanding stealer market with significant campaigns since it emerged as early as late 2022

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkey vs Password: Which is More Secure? | LastPass

Explore the differences between passkeys and passwords. Learn how LastPass enhances security and simplifies access with advanced authentication methods.

Blog

Blog

Recent

News & Insights

Cybersecurity

Product Tutorials

Threat Intel

Product Updates

Tips And Tricks

Introducing Secure Access Experiences: Controlling the Chaos of Modern App Sprawl

Dark Side of the Lumma: What the Lumma stealer takedown means for the infostealer market and your personal data

Passkeys Explained: Will Passwords Ever Go Away?

Your Small Business Guide to Agentic AI Identity & Access Management (2026)

The Phish Bowl Explores How Identity is Under Attack, Scattered LAPSUS$ Hunters, and Cybercrime Trends

Subscribe & Save 20% off Premium or Families plans

What Is AI Agent Authentication, and Why Does Your Small Business Need It in 2026?

January 2026 Phishing Campaign Targeting LastPass Customers [UPDATE]

What Are Zero-Day Exploits, and Why Are They So Dangerous in 2026?

New Phishing Campaign Targeting LastPass Customers

SSRF Attacks Are Up 452%: Here’s Your 5-Minute Business-Friendly SSRF Prevention Guide

What Is Cross Site Request Forgery? The 5-Minute CSRF Guide for Business Owners

Strengthening Cyber Resilience Through Partnership: Insights from Australia and New Zealand

Online Scam Alert: 20 Must-Know Online Scams + Your 2026 Defense Guide

The Phish Bowl explores what’s inside the 2026 cybersecurity crystal ball: identity, AI & new threats