Dashlane Device-Registration API 2FA OTP Brute-Force Campaign — Encrypted Vaults of <20 Personal-Plan Accounts Exfiltrated (May–June 2026) — Threadlinqs Intelligence
As of 2026-06-07, Dashlane Device-Registration API 2FA OTP Brute-Force Campaign — Encrypted Vaults of <20 Personal-Plan Accounts Exfiltrated (May–June 2026) is a high-severity data breach threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 12 indicators of compromise.
Threat ID: TL-2026-0705 · Severity: HIGH · Status: ACTIVE · Category: DATA_BREACH
Beginning May 31, 2026, an external attacker brute-forced Dashlane's device-registration API by flooding it with automated requests to guess the 6-digit one-time 2FA tokens (email OTP / authenticator
Dashlane, a widely deployed cloud password manager, disclosed an account-takeover campaign in which an external attacker abused the device-registration (new-device enrollment) API to bypass two-factor authentication and exfiltrate encrypted user vaults. This is an attack campaign against a SaaS authentication flow, not a product vulnerability with an assigned CVE.
ATTACK MECHANICS: When a Dashlane account is accessed from an unrecognized device, the device-enrollment flow requires a 6-digit verification token — delivered either as a one-time code to the account's registered email address, or, for users with app-based 2FA enabled, as a TOTP code from an authenticator app. A 6-digit numeric token has only 1,000,000 possible values (10^6). The attacker scripted high-volume automated requests against the device-registration API endpoints, rapidly submitting candidate codes to guess a valid token before it expired. Where server-side rate limiting, attempt lockout, and token-lifetime windows were insufficient to fully bound the guess space, the attacker generated valid tokens, completed device registration on the targeted account, and used the newly trusted device to download a full copy of that account's encrypted vault. This is a classic OTP/2FA brute-force (credential-stuffing-adjacent) attack moved up the stack to the device-trust enrollment API rather than the login form.
SCOPE & IMPACT: Fewer than 20 personal subscription accounts were successfully compromised to the point of vault download. A larger but undisclosed number of accounts were targeted; the abnormal request volume against those accounts triggered Dashlane's automatic abuse safeguards, which temporarily suspended/locked the targeted accounts. The exfiltrated artifact is the encrypted vault blob. Because Dashlane uses a zero-knowledge model, the master password (and the keys derived from it) are never transmitted to or stored by Dashlane, so the downloaded vaults cannot be decrypted server-side and remain protected by the strength of each user's master password. The residual risk is offline password-cracking of the stolen vault blobs — the same risk class that allowed cracking of weakly-protected LastPass vaults exfiltrated in the 2022–2025 timeframe. There was no evidence of compromise of Dashlane internal systems or infrastructure.
VENDOR RESPONSE: Automatic security controls locked the targeted accounts during the attack as a safeguard. Affected users were notified, locked accounts were restored, and Dashlane deployed additional network- and product-level protections to filter the malicious traffic and added further verification steps to the device-registration flow. Dashlane noted that, given vault encryption, the realistic path to vault contents requires the master password — most plausibly obtained via phishing rather than brute-forcing the encryption.
DEFENSIVE RELEVANCE: The novel/notable TTP is API-level OTP brute-force against a device-enrollment endpoint to bypass 2FA, rather than against the primary login. Detection should focus on high-rate, high-cardinality OTP submission patterns against enrollment/registration endpoints, anomalous new-device registrations, and geovelocity/ASN anomalies on device-trust events. Affected end users should rotate the master password, audit and revoke unrecognized registered devices, rotate high-value stored credentials, and ensure the master password is long and unique to resist offline cracking of any exfiltrated vault.
Weaknesses (CWE)
CWE-307, CWE-799, CWE-770, CWE-308, CWE-287
Target sectors: consumer, technology, any (individual end-users)
Target regions: Global
Detections & IOCs
As of 2026-08-10, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 12 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
DATA_BREACH, HIGH, threat intelligence, cybersecurity, T1110, T1110.001, T1111, T1078, T1078.004, T1556.006, T1098.005, T1213, T1555, T1552
