# Dashlane Device-Registration API 2FA OTP Brute-Force Campaign — Encrypted Vaults of <20 Personal-Plan Accounts Exfiltrated (May–June 2026)

> Beginning May 31, 2026, an external attacker brute-forced Dashlane's device-registration API by flooding it with automated requests to guess the 6-digit one-time 2FA tokens (email OTP / authenticator code) required to enroll a new device. Valid tokens were generated for fewer than 20 personal-plan accounts, attacker-controlled devices were registered, and copies of those users' encrypted vaults were downloaded. Dashlane's zero-knowledge architecture means master passwords are never stored server-side, so the exfiltrated vaults remain encrypted; automatic abuse controls locked targeted accounts, access was later restored, and network/product-level filtering plus added device-registration verification were deployed. Publicly disclosed June 2–5, 2026.

- **Published:** 2026-06-07T00:00:00Z
- **Last reviewed:** 2026-06-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0705
- **ID:** TL-2026-0705
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Dashlane, a widely deployed cloud password manager, disclosed an account-takeover campaign in which an external attacker abused the device-registration (new-device enrollment) API to bypass two-factor authentication and exfiltrate encrypted user vaults. This is an attack campaign against a SaaS authentication flow, not a product vulnerability with an assigned CVE.

ATTACK MECHANICS: When a Dashlane account is accessed from an unrecognized device, the device-enrollment flow requires a 6-digit verification token — delivered either as a one-time code to the account's registered email address, or, for users with app-based 2FA enabled, as a TOTP code from an authenticator app. A 6-digit numeric token has only 1,000,000 possible values (10^6). The attacker scripted high-volume automated requests against the device-registration API endpoints, rapidly submitting candidate codes to guess a valid token before it expired. Where server-side rate limiting, attempt lockout, and token-lifetime windows were insufficient to fully bound the guess space, the attacker generated valid tokens, completed device registration on the targeted account, and used the newly trusted device to download a full copy of that account's encrypted vault. This is a classic OTP/2FA brute-force (credential-stuffing-adjacent) attack moved up the stack to the device-trust enrollment API rather than the login form.

SCOPE & IMPACT: Fewer than 20 personal subscription accounts were successfully compromised to the point of vault download. A larger but undisclosed number of accounts were targeted; the abnormal request volume against those accounts triggered Dashlane's automatic abuse safeguards, which temporarily suspended/locked the targeted accounts. The exfiltrated artifact is the encrypted vault blob. Because Dashlane uses a zero-knowledge model, the master password (and the keys derived from it) are never transmitted to or stored by Dashlane, so the downloaded vaults cannot be decrypted server-side and remain protected by the strength of each user's master password. The residual risk is offline password-cracking of the stolen vault blobs — the same risk class that allowed cracking of weakly-protected LastPass vaults exfiltrated in the 2022–2025 timeframe. There was no evidence of compromise of Dashlane internal systems or infrastructure.

VENDOR RESPONSE: Automatic security controls locked the targeted accounts during the attack as a safeguard. Affected users were notified, locked accounts were restored, and Dashlane deployed additional network- and product-level protections to filter the malicious traffic and added further verification steps to the device-registration flow. Dashlane noted that, given vault encryption, the realistic path to vault contents requires the master password — most plausibly obtained via phishing rather than brute-forcing the encryption.

DEFENSIVE RELEVANCE: The novel/notable TTP is API-level OTP brute-force against a device-enrollment endpoint to bypass 2FA, rather than against the primary login. Detection should focus on high-rate, high-cardinality OTP submission patterns against enrollment/registration endpoints, anomalous new-device registrations, and geovelocity/ASN anomalies on device-trust events. Affected end users should rotate the master password, audit and revoke unrecognized registered devices, rotate high-value stored credentials, and ensure the master password is long and unique to resist offline cracking of any exfiltrated vault.

## MITRE ATT&CK

- T1110 Brute Force
- T1110.001 Brute Force: Password Guessing
- T1111 Multi-Factor Authentication Interception
- T1078 Valid Accounts
- T1078.004 Valid Accounts: Cloud Accounts
- T1556.006 Modify Authentication Process: Multi-Factor Authentication
- T1098.005 Account Manipulation: Device Registration
- T1213 Data from Information Repositories
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1567 Exfiltration Over Web Service
- T1589.001 Gather Victim Identity Information: Credentials
- T1583 Acquire Infrastructure

## Sources

- [Security advisory: Brute force attack on Dashlane user accounts](https://support.dashlane.com/hc/en-us/articles/36038764990866-Security-advisory-Brute-force-attack-on-Dashlane-user-accounts)
- [Dashlane Brute-Force Attack Leads to Limited Encrypted Vault Downloads](https://www.securityweek.com/dashlane-brute-force-attack-leads-to-limited-encrypted-vault-downloads/)
- [Attackers obtained encrypted password vaults from some Dashlane user accounts](https://www.helpnetsecurity.com/2026/06/05/dashlane-brute-force-attack-vaults-customer-accounts/)
- [Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded](https://thehackernews.com/2026/06/dashlane-discloses-brute-force-attack.html)
- [MITRE ATT&CK T1110 — Brute Force](https://attack.mitre.org/techniques/T1110/)
- [OWASP Authentication Cheat Sheet — Rate Limiting & MFA](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0705