# Phishing Campaign Impersonates LastPass and Bitwarden Security Alerts to Deliver Fake DocuSign Pages

> A phishing campaign spoofs LastPass and Bitwarden corporate newsletter addresses (hello@lastpassnewsletter.com, hello@bitwardennewsletter.com) to send fake security-policy update emails, driving victims to fraudulent DocuSign-styled landing pages at lastpasscompliance[.]com and bitwardencompliance[.]com that prompt Windows/macOS downloads. It is the fourth documented wave of LastPass/Bitwarden brand-impersonation phishing since October 2025, following campaigns that delivered the Syncro RMM tool and ScreenConnect for full vault/endpoint compromise.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1315
- **ID:** TL-2026-1315
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 14, 2026, BleepingComputer reported an active phishing campaign impersonating both LastPass and Bitwarden — two of the most widely used cross-platform password managers — using spoofed corporate-newsletter sender addresses (hello@lastpassnewsletter.com and hello@bitwardennewsletter.com). The lures present as routine security-policy update notifications and direct recipients to "Review & Access Terms" on fraudulent, DocuSign-branded landing pages hosted at lastpasscompliance[.]com and bitwardencompliance[.]com. Both domains were flagged as malicious by Microsoft Defender for Office 365 and Cloudflare; the LastPass-themed domain was already taken offline by publication time, indicating active takedown response. The DocuSign-styled pages present a fake "document for review" and prompt victims to download a client supporting both Windows and macOS — mirroring the cross-platform delivery model used in prior waves of this same campaign family — with the final payload's objective unconfirmed at time of reporting.

This is not an isolated incident. It is the latest in a sustained, recurring pattern of LastPass/Bitwarden brand-impersonation phishing dating back at least to October 16, 2025, when a nearly identical campaign (sender domains lastpasspulse[.]blog / lastpasjournal[.]blog, weekend-timed for reduced defender response) used fake "we have been hacked" breach alerts to trick users into installing an MSI-based binary that silently deployed the Syncro remote monitoring and management (RMM) tool, beaconing to a C2 server roughly every 90 seconds and configured to evade Emsisoft, Webroot, and Bitdefender. Syncro was then used to pull down ScreenConnect for full interactive remote access, file enumeration, credential harvesting, and password-vault compromise. A follow-on wave beginning January 19, 2026 used fake "scheduled maintenance" emails urging users to create local vault backups within 24 hours (also credential-harvesting bait), and a March 1, 2026 wave used display-name-spoofed forwarded-message lures (subjects like "Re: pending approval", "Fwd: Re: your request") pointing to a fake LastPass SSO page at verify-lastpass[.]com, hosted behind compromised third-party redirect domains (hancochem[.]at, atomicminerals[.]ca, redlakegold[.]ca, bedfordmetals[.]com, 79resources[.]com). LastPass has publicly confirmed on its own blog that these campaigns are unauthorized abuse of its brand and that no LastPass systems were compromised.

The consistent playbook across all four waves — spoofed/lookalike sender infrastructure, urgency-driven security/compliance framing, cross-platform malicious downloads, and rapid domain rotation — indicates a persistent, financially motivated actor or affiliate group targeting the large installed base of password-manager users to obtain master-password/vault access, a high-value target because a single successful compromise can cascade into every credential a victim has stored. Neither the specific payload delivered by the July 14 DocuSign-styled pages nor definitive attribution linking it to the same actor behind the Syncro/ScreenConnect and verify-lastpass waves has been confirmed by public reporting; documentation below treats the July 14 IOCs as the confirmed incident and the prior waves as sourced related-campaign context supporting the TTP pattern.

## MITRE ATT&CK

- T1583.001 Domains
- T1585.002 Email Accounts
- T1587.001 Malware
- T1566.002 Spearphishing Link
- T1566.001 Spearphishing Attachment
- T1598.003 Spearphishing Link
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1056.001 Keylogging
- T1555 Credentials from Password Stores
- T1110 Brute Force
- T1083 File and Directory Discovery
- T1113 Screen Capture
- T1219 Remote Access Tools
- T1071.001 Web Protocols
- T1041 Exfiltration Over C2 Channel

## Sources

- [LastPass, Bitwarden users targeted with fake security alerts](https://www.bleepingcomputer.com/news/security/lastpass-bitwarden-users-targeted-with-fake-security-alerts/)
- [Phishing Campaign Targets LastPass and Bitwarden Users](https://www.ampcuscyber.com/shadowopsintel/phishing-campaign-targets-lastpass-and-bitwarden-users/)
- [LastPass and Bitwarden users are being targeted by phishing emails](https://www.pcworld.com/article/2944308/lastpass-and-bitwarden-password-managers-targeted-by-phishing-campaign.html)
- [Fake LastPass and Bitwarden 'Breach Alerts' Lead to PC Hijacks via Remote Access Tools](https://dailysecurityreview.com/cyber-security/fake-lastpass-and-bitwarden-breach-alerts-lead-to-pc-hijacks-via-remote-access-tools/)
- [LastPass, Bitwarden spoofed in ongoing phishing campaign](https://www.scworld.com/brief/lastpass-bitwarden-spoofed-in-ongoing-phishing-campaign)
- [LastPass Warns of Fake Maintenance Messages Targeting Users' Master Passwords](https://thehackernews.com/2026/01/lastpass-warns-of-fake-maintenance.html)
- [Fake LastPass maintenance emails target users](https://www.malwarebytes.com/blog/news/2026/01/fake-lastpass-maintenance-emails-target-users)
- [LastPass warns of spoofed alerts aimed at stealing master passwords](https://securityaffairs.com/188911/security/lastpass-warns-of-spoofed-alerts-aimed-at-stealing-master-passwords.html)
- [LastPass warns of fake security alerts targeting account credentials](https://cyberinsider.com/lastpass-warns-of-fake-security-alerts-targeting-account-credentials/)
- [New Phishing Campaign Targeting LastPass Customers](https://blog.lastpass.com/posts/new-phishing-campaign-targeting-lastpass-customers)
- [LastPass Alerts Customers of Fake Email Chains Used in New Phishing Campaign; No Impact to LastPass Systems](https://blog.lastpass.com/posts/march-2026-phishing-campaign-targeting-lastpass-customers)
- [Password Manager Phishing Attacks: How LastPass, 1Password & Bitwarden Are Impersonated](https://www.phishingbox.com/news/post/password-manager-phishing-attacks-how-lastpass-1password-bitwarden-are-impersonated)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1315