Dashlane Device-Registration API 2FA OTP Brute-Force Campaign — Encrypted Vaults of <20 Personal-Plan Accounts Exfiltrated (May–June 2026)
Dashlane Device-Registration API 2FA OTP Brute-Force (TL-2026-0705), also tracked as Dashlane 2FA Brute-Force Incident, is a high-severity data breach, first published 2026-06-07. It has no confirmed attribution, affects Dashlane Dashlane Password Manager (personal subscription plans), maps to 13 MITRE ATT&CK techniques (T1078, T1078.004, T1098.005), and is covered by 9 detection rules and 12 indicators of compromise.
Key facts for TL-2026-0705
- Threat ID
- TL-2026-0705
- Also known as
- Dashlane 2FA Brute-Force Incident, Dashlane Device-Registration Vault Exfiltration
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- 2026-06-07
- Last reviewed
- 2026-06-07
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- consumer, technology, any (individual end-users)
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Beginning May 31, 2026, an external attacker brute-forced Dashlane's device-registration API by flooding it with automated requests to guess the 6-digit one-time 2FA tokens (email OTP / authenticator code) required to enroll a new device. Valid tokens were generated for fewer than 20 personal-plan accounts, attacker-controlled devices were registered, and copies of those users' encrypted vaults were downloaded. Dashlane's zero-knowledge architecture means master passwords are never stored server-side, so the exfiltrated vaults remain encrypted; automatic abuse controls locked targeted accounts, access was later restored, and network/product-level filtering plus added device-registration verification were deployed. Publicly disclosed June 2–5, 2026.
How Dashlane Device-Registration API 2FA OTP Brute-Force works
Dashlane, a widely deployed cloud password manager, disclosed an account-takeover campaign in which an external attacker abused the device-registration (new-device enrollment) API to bypass two-factor authentication and exfiltrate encrypted user vaults. This is an attack campaign against a SaaS authentication flow, not a product vulnerability with an assigned CVE.
ATTACK MECHANICS: When a Dashlane account is accessed from an unrecognized device, the device-enrollment flow requires a 6-digit verification token — delivered either as a one-time code to the account's registered email address, or, for users with app-based 2FA enabled, as a TOTP code from an authenticator app. A 6-digit numeric token has only 1,000,000 possible values (10^6). The attacker scripted high-volume automated requests against the device-registration API endpoints, rapidly submitting candidate codes to guess a valid token before it expired. Where server-side rate limiting, attempt lockout, and token-lifetime windows were insufficient to fully bound the guess space, the attacker generated valid tokens, completed device registration on the targeted account, and used the newly trusted device to download a full copy of that account's encrypted vault. This is a classic OTP/2FA brute-force (credential-stuffing-adjacent) attack moved up the stack to the device-trust enrollment API rather than the login form.
SCOPE & IMPACT: Fewer than 20 personal subscription accounts were successfully compromised to the point of vault download. A larger but undisclosed number of accounts were targeted; the abnormal request volume against those accounts triggered Dashlane's automatic abuse safeguards, which temporarily suspended/locked the targeted accounts. The exfiltrated artifact is the encrypted vault blob. Because Dashlane uses a zero-knowledge model, the master password (and the keys derived from it) are never transmitted to or stored by Dashlane, so the downloaded vaults cannot be decrypted server-side and remain protected by the strength of each user's master password. The residual risk is offline password-cracking of the stolen vault blobs — the same risk class that allowed cracking of weakly-protected LastPass vaults exfiltrated in the 2022–2025 timeframe. There was no evidence of compromise of Dashlane internal systems or infrastructure.
VENDOR RESPONSE: Automatic security controls locked the targeted accounts during the attack as a safeguard. Affected users were notified, locked accounts were restored, and Dashlane deployed additional network- and product-level protections to filter the malicious traffic and added further verification steps to the device-registration flow. Dashlane noted that, given vault encryption, the realistic path to vault contents requires the master password — most plausibly obtained via phishing rather than brute-forcing the encryption.
DEFENSIVE RELEVANCE: The novel/notable TTP is API-level OTP brute-force against a device-enrollment endpoint to bypass 2FA, rather than against the primary login. Detection should focus on high-rate, high-cardinality OTP submission patterns against enrollment/registration endpoints, anomalous new-device registrations, and geovelocity/ASN anomalies on device-trust events. Affected end users should rotate the master password, audit and revoke unrecognized registered devices, rotate high-value stored credentials, and ensure the master password is long and unique to resist offline cracking of any exfiltrated vault.
MITRE ATT&CK techniques used in TL-2026-0705
Initial Access
T1078 Valid Accounts; T1078.004 Valid Accounts: Cloud Accounts
Persistence
T1098.005 Account Manipulation: Device Registration
Credential Access
T1110 Brute Force; T1110.001 Brute Force: Password Guessing; T1111 Multi-Factor Authentication Interception; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Collection
T1213 Data from Information Repositories
defense-impairment
T1556.006 Modify Authentication Process: Multi-Factor Authentication
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Reconnaissance
Affected products and versions in Dashlane Device-Registration API 2FA OTP Brute-Force
- Dashlane — Dashlane Password Manager (personal subscription plans)
Vulnerable versions: Cloud service device-registration API (as of May 2026)
Fixed in: Server-side mitigation deployed June 2026 (network/product filtering + added device-registration verification)
Remediation for Dashlane Device-Registration API 2FA OTP Brute-Force
Patches
- No patch — SaaS provider deployed server-side network/product-level traffic filtering and added device-registration verification steps
Immediate actions
- Audit registered devices in Dashlane account settings and revoke any unrecognized device immediately
- Rotate the Dashlane master password to a long, unique passphrase (resists offline cracking of any exfiltrated vault)
- Rotate high-value credentials stored in the vault (banking, email, admin, SSO) for potentially exposed accounts
- Enable app-based (authenticator) 2FA rather than relying solely on email OTP where available
Workarounds
- Monitor for and revoke unexpected new-device registrations
- Treat any exfiltrated vault as recoverable if master password is weak — rotate accordingly
Longer-term hardening
- Enforce strict per-account and per-IP rate limiting plus hard attempt-count lockout on device-registration/OTP endpoints
- Reduce OTP validity window and bind OTP attempts to a single device-enrollment session token
- Add CAPTCHA/proof-of-work and anomaly-based bot filtering to device-registration APIs
- Alert users on every new-device registration and require explicit out-of-band approval for high-risk enrollments
Weaknesses (CWE) in Dashlane Device-Registration API 2FA OTP Brute-Force
CWE-307, CWE-799, CWE-770, CWE-308, CWE-287
Timeline of Dashlane Device-Registration API 2FA OTP Brute-Force
- Attacker generates valid tokens for fewer than 20 personal-plan accounts, registers attacker-controlled devices, and downloads copies of the victims' encrypted vaults.
- Abnormal request volume on targeted accounts triggers Dashlane's automatic abuse safeguards, temporarily locking/suspending targeted accounts.
- Attacker begins high-volume automated brute-force requests against Dashlane device-registration API endpoints to guess 6-digit 2FA enrollment tokens.
- Dashlane begins disclosing the incident following user reports; states vault data cannot be accessed without the master password.
- Dashlane releases an updated advisory with additional technical detail on the device-registration API brute-force and mitigations deployed.
- Dashlane deploys network/product-level traffic filtering and adds verification steps to the device-registration flow; locked accounts restored and affected users notified.
- SecurityWeek, Help Net Security, and The Hacker News publish coverage; scope confirmed as fewer than 20 personal-plan accounts with encrypted vaults downloaded.
Sources cited for Dashlane Device-Registration API 2FA OTP Brute-Force
- Security advisory: Brute force attack on Dashlane user accounts
- Dashlane Brute-Force Attack Leads to Limited Encrypted Vault Downloads
- Attackers obtained encrypted password vaults from some Dashlane user accounts
- Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded
- MITRE ATT&CK T1110 — Brute Force
- OWASP Authentication Cheat Sheet — Rate Limiting & MFA
Threats related to Dashlane Device-Registration API 2FA OTP Brute-Force
Detection coverage for TL-2026-0705
As of 2026-06-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0705 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.