Google’s General Counsel discusses the rise of AI-driven phishing scams

Halimah Delaine Prado, Google’s General Counsel, has pointed out an alarming trend: the increase of AI-enhanced phishing attacks originating from companies outside the U.S., particularly in China. These criminals are leveraging artificial intelligence to craft convincing fake websites that mimic well-known brands like T-Mobile, managing to deceive many Americans and leading to significant financial losses. She emphasized how Google is strategizing to tackle these evolving threats.

Opening your inbox might reveal an email about a security policy update—nothing suspicious at first glance. The design is polished, the wording seems official, and the buttons make confirming changes feel effortless. It’s this very presentation that poses a risk.

LastPass has alerted its users about a new phishing campaign that employs lookalike domains and fake DocuSign pages to lure individuals into downloading potentially harmful software. Thankfully, LastPass confirmed that its systems remain secure. However, scammers are counting on users to trust the familiar logo and bypass a closer inspection of the website link.

The phishing email in question comes from hello@lastpassnewsletter.com, with subject lines like: “Required action: Review the updated LastPass security policy.” The email claims adjustments have been made to their service policy and hints at improved monitoring capabilities. Though these details sound legitimate, the sending domain actually belongs to an attacker, as LastPass clarifies that LastPassNewsletter.com isn’t connected to their organization.

Fake LastPass page mimics DocuSign

If users click the provided button, they will be directed to lastpasscompliance.com, which is designed to resemble a DocuSign page and claims a document awaits their review. This deception is particularly effective, as many people frequently receive electronic signature requests, making them less cautious. LastPass noted that both Microsoft Defender for Office 365 and Cloudflare have categorized this phishing site as malicious. The fake page urged visitors to download programs compatible with Windows and macOS.

While LastPass was still probing the downloads at the time of the warning, users are advised to treat any files from this site as suspicious. The page even included a live chat feature, but it’s unclear if that function operated as intended. Although the malicious page was offline when reported, attackers can quickly switch to new domains.

Similar alerts target Bitwarden users

LastPass users aren’t alone; Bitwarden customers have also received a similar phishing email from hello@bitwardennewsletter.com, pointing to bitwardencompliance.com. This pattern indicates attackers may be replicating tactics across various password manager platforms.

Customers of password managers are appealing targets since cracking one master password can compromise numerous accounts. Depending on your security settings, multi-factor authentication might be bypassed.

Password managers do offer substantial protection. Autofill features can actually help reveal counterfeit sites because users must pay attention to valid URLs. A quick comparison of password manager options is readily available online.

Recent phishing attempts targeting LastPass users

Earlier this year, LastPass users were faced with several phishing attempts. In January, a false notification warned them to back up their vaults within 24 hours due to maintenance. A March campaign utilized a fraudulent email conversation about unauthorized access to accounts. Both methods played on urgency, prompting immediate action before users could think twice. The latest compliance notice, however, adopts a more serious tone, making it feel like an everyday administrative process rather than a crisis—an approach that can catch people off guard.

Protecting yourself from LastPass phishing scams

Here are steps to mitigate the risks posed by these phishing attempts:

1) Avoid clicking the policy review button

It’s best to delete the email or flag it as phishing. Don’t respond or click any links.

2) Access LastPass directly

Utilize the official LastPass app or type lastpass.com in your browser to verify notifications by logging in securely.

3) Scrutinize the entire domain

Be cautious of lookalike domains that might include “newsletter” or “compliance.” A legitimate LastPass URL must end in lastpass.com.

4) Pay attention if autofill is inactive

If your password manager doesn’t automatically enter credentials on a dubious domain, heed that as a warning. Avoid copying and pasting passwords; instead, close the page and navigate to the official site.

5) Change your master password if necessary

If you have inadvertently entered it, access LastPass from a trusted device to change your master password right away. Also, check for any unusual activity in your vault.

6) Treat unsolicited downloads with suspicion

Avoid opening software linked in emails claiming to be from security alerts. If you downloaded anything, disconnect that device from the internet and run a virus scan.

7) Implement multi-factor authentication

Enable this feature for your password manager and other vital accounts to add an additional layer of security. Just be careful—not to respond to unexpected prompts.

8) Limit the personal information accessible to fraudsters

Scammers often exploit details from data broker sites to make their phishing emails more convincing. Data deletion services can assist in removing this information from the internet.

9) Report any suspicious LastPass messages

Forward such emails to abuse@lastpass.com; LastPass advises that no representative will ever ask for your master password.

Key takeaways

The danger in this scam lies in its ordinariness. Many users expect dire warnings from password managers, but this email camouflages itself as an easy administrative update. Always check the web address, as just because a domain includes a known brand doesn’t mean it’s legitimate. Protect your master password like it’s the key to your home.

Have you ever come across a seemingly genuine security email? What made you pause and examine it closer? Share your thoughts.