From fake logins to live hijacking: How phishing targeting LastPass customers has evolved

Given our position within the technology sector and the services we provide to our customers, the LastPass Threat Intelligence team has unique insight into the changing threat environment as it relates to phishing. Like the rest of the cyber security industry, we see AI playing a growing role in phishing campaigns targeting our customers, changing everything from the way phishing campaigns are run (e.g., leveraging AI to automate email generation and distribution) to the development of custom phishing kits on demand by less technical threat actors. 

In this presentation, we will provide insights into recent phishing campaigns we have observed and disrupted. Our intent is to continuously update this presentation until the day it is delivered, but some campaigns we will cover include: 

A recent campaign using a custom phishing kit that inexplicably leveraged a relatively unsophisticated lure that mimicked an exchange between an unknown third-party and LastPass customer service that attempted to portray an account takeover attempt and asking the customer to verify their account. The email included a link to an interstitial page with a complex bot/security researcher-detection scoring system that would either redirect to our legitimate site or to a phishing site. The phishing emails included victim identifiers, allowing for tracking of individual engagement. This also helped identify potential security researcher engagement on the phishing site through the use of alternate and/or security researcher-controlled accounts. 

The HTML code bore indications of AI-assistance in the code creation. While there are similarities to other phishing sites, this particular campaign seemed to be highly targeted focusing on LastPass. The content of the emails themselves bore indicators of AI generation. Pivoting off of elements of the first campaign, we detected a second, more sophisticated campaign leveraging an attacker-in-the-middle approach, harvesting credentials in real time and using an attacker controlled phishing site as a passthrough to a legitimate LastPass login page. This approach also allowed for the collection of session tokens in real time. 

As this presentation will be actively in development, we will continue to update our case studies and add more technical details that will allow organisations to recognize similar activity. We will also share our lessons learned in our campaign detection and takedown efforts, as well as internal detections that helped us identify similar activity based on account interactions when possible.