LastPass and Bitwarden fake-breach phishing campaign
Campaign
Summary
Hide ▲
Show ▼
An ongoing phishing campaign is impersonating LastPass and Bitwarden to push users toward a fake desktop password-manager app, creating a risk of PC hijacking and data theft. The lure uses fabricated breach alerts to increase urgency and steer recipients to a malicious download path. The activity started over the Columbus Day holiday weekend and appears designed to blend social engineering with remote-access tooling.
Related Happenings
OAuth device-code phishing campaign targeting SaaS accounts
Campaign
H score43
First: 04.04.2026 17:17
Last: 04.04.2026 17:17
Sources 1
About this happening:
A device code phishing campaign now includes EvilTokens, a phishing-as-a-service kit sold on Telegram that uses the OAuth 2.0 device authorization flow to hija...
OAuth device-code phishing campaign targeting SaaS accounts
CampaignAbout this happening: A device code phishing campaign now includes EvilTokens, a phishing-as-a-service kit sold on Telegram that uses the OAuth 2.0 device authorization flow to hija...
TikTok for Business phishing campaign using Turnstile and reverse proxy
Campaign
H score31
First: 26.03.2026 16:09
Last: 26.03.2026 16:09
Sources 1
About this happening:
A phishing campaign is targeting TikTok for Business accounts and uses Cloudflare Turnstile to block automated analysis before exposing a reverse-proxy credential-...
TikTok for Business phishing campaign using Turnstile and reverse proxy
CampaignAbout this happening: A phishing campaign is targeting TikTok for Business accounts and uses Cloudflare Turnstile to block automated analysis before exposing a reverse-proxy credential-...
Compromised legitimate WordPress websites used to infect visitors with infostealer malware campaign expands across multiple victims
Campaign
H score34
First: 11.03.2026 16:45
Last: 11.03.2026 16:45
Sources 1
About this happening:
A global ClickFix campaign is abusing compromised WordPress sites to push infostealer malware to visitors, putting credentials and financial data at risk. The operatio...
Compromised legitimate WordPress websites used to infect visitors with infostealer malware campaign expands across multiple victims
CampaignAbout this happening: A global ClickFix campaign is abusing compromised WordPress sites to push infostealer malware to visitors, putting credentials and financial data at risk. The operatio...
Tycoon 2FA-Storm-1747 ecosystem shift changes threat-actor operations
Threat Actor Meta
H score82
First: 05.03.2026 08:51
Last: 05.03.2026 08:51
Sources 1
About this happening:
Tycoon2FA has shifted from a subscription-based PhaaS and AitM credential harvester into a more resilient campaign that now uses device-code phishing against Mic...
Tycoon 2FA-Storm-1747 ecosystem shift changes threat-actor operations
Threat Actor MetaAbout this happening: Tycoon2FA has shifted from a subscription-based PhaaS and AitM credential harvester into a more resilient campaign that now uses device-code phishing against Mic...
Latest development: 17.05.2026 17:43
eSentire says Tycoon2FA now uses device-code phishing to target Microsoft 365 accounts, with invoice-themed lure emails carrying Trustifi click-tracking URLs that redirect through Trustifi, Cloudflare Workers, obfuscated JavaScript layers, and a fake Microsoft CAPTCHA page before sending victims to microsoft.com/devicelogin. The kit also adds anti-analysis defenses, including detection of Selenium, Puppeteer, Playwright, and Burp Suite, plus blocks for security vendors, VPNs, sandboxes, AI crawlers, and cloud providers.
LastPass users phishing campaign using fake support threads
Campaign
H score37
First: 04.03.2026 22:44
Last: 04.03.2026 22:44
Sources 1
About this happening:
A phishing campaign is targeting LastPass users with fake account-access alerts, putting vault credentials at risk. The lure uses spoofed support threads and urgent li...
LastPass users phishing campaign using fake support threads
CampaignAbout this happening: A phishing campaign is targeting LastPass users with fake account-access alerts, putting vault credentials at risk. The lure uses spoofed support threads and urgent li...
Timeline
-
15.10.2025 22:22 2 articles · 9mo ago
Fake LastPass and Bitwarden breach alerts
Initial DisclosureAn ongoing phishing campaign targets LastPass and Bitwarden users with fake emails claiming the password managers were hacked and urging recipients to download a supposedly more secure desktop app; the downloaded binary installs Syncro MSP tooling, the threat actors use Syncro to deploy ScreenConnect for remote access, and Cloudflare is blocking the fraudulent landing pages as phishing attempts.
Show sources
- Fake LastPass, Bitwarden breach alerts lead to PC hijacks — www.bleepingcomputer.com — 15.10.2025 22:22
- Fake LastPass, Bitwarden breach alerts lead to PC hijacks — www.bleepingcomputer.com — 15.10.2025 22:22