onepass-word[.]com

An ongoing phishing campaign is targeting LastPass and Bitwarden users with fake emails claiming that the companies were hacked, urging them to download a supposedly more secure desktop version of the password manager. The messages direct recipients to download a binary that BleepingComputer has discovered installs Syncro, a remote monitoring and management (RMM) tool used by managed service providers (MSP) to streamline IT operations. The threat actors are using the Syncro MSP program to deploy the ScreenConnect remote support and access software. 'Vulnerable' old .EXE installs In a threat alert this week, LastPass makes it clear that the company did not suffer any cybersecurity incident and that the messages are a social engineering effort by a threat actor. "To be clear, LastPass has NOT been hacked, and this is an attempt on the part of a malicious actor to draw attention and generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails," LastPass says. According to the company, the campaign started over the weekend, presumably to take advantage of the reduced staffing over the Columbus Day holiday weekend and delay detection. The phishing emails are well crafted and urge recipients to install a more secure desktop app that LastPass developed as an MSI replacement for the "outdated .exe format" that had weakenesses that allowed access to vault information. “Attackers exploited weaknesses in older .exe installations, which could, under certain conditions, allow unauthorized access to cached vault data,” reads the fake security alert from the threat actor. LastPass notes that the fake messages come from ‘hello@lastpasspulse[.]blog’ but BleepingComputer also saw emails delivered from ‘hello@lastpasjournal[.]blog’. Bitwarden users also targeted The phishing emails also impersonate Bitwarden and share the same writing style and lure in an attempt to create a sense of urgency and convince recipients to follow the download link to an improved deskop application. Yesterday, BleepingComputer received a notice from ‘[email protected]’ describing a similar security incident that prompted the release of a secure client app that users need to install. At the time of writing, Cloudflare is blocking access to the landing pages included in the fraudulent emails and is marking them as phishing attempts. Legitmate tools for remote access BleepingComputer retrieved the binary samples distributed in the phishing emails targeting LastPass and Bitwarden users and found that they are functionally the same. The malware installs the Syncro MSP platform agent with parameters that hide its system tray icon in an effort to keep the user unaware of the new tool. Based on our observations, Syncro's single purpose appears to be to deploy the ScreenConnect support tool as a "bring-your-own" installer, which gives the threat actor remote access to the endpoint. The Syncro agent is configured with very few options, suggesting that the threat actor limited to just the functionality they needed. The configuration files shows that the agent checks in with the server every 90 seconds. It does not have enabled the built-in remote access and doesn't deploy the remote support utilities Splashtop, which is bundled with the Syncro platform, or TeamViewer, for which an integration exists. Furthermore, the extracted configuration did not contain policies to deploy security solutions on the compromised endpoint, and disabled the Emsisoft, Webroot, and Bitdefender agents. Once ScreenConnect is installed on a device, the threat actors can remotely connect to a target's computer and deploy further malware payloads, steal data, and potentially access the password vaults of users through saved credentials. Phishing for 1Password accounts Last week, another campaign targeted 1Password users with emails falsely warning that their accounts had been compromised. The indicators for that activity, from the wording in the message and landing URL, to the sender address (watchtower@eightninety[.]com) were different. Researchers at cybersecurity company Malwarebytes say that users clicking on an embedded button were taken to a phishing page (onepass-word[.]com) via a Mandrillapp redirection. The attacks targeting 1Password were first reported by Brett Christensen (Hoax-Slayer) on September 25. Users of password management tools should ignore such alerts and always login to the provider’s official website to check for any security alerts pending review. Important security incidents like those claimed in the emails are also broadly communicated across the companies’ blogs and via press releases, so double-checking on official channels is always a good practice. It is also worth remembering that companies won't ever ask for the master password to your vaults. Update 10/16 - Syncro sent the below statement to BleepingComputer regarding the phishing campaign: "We identified the malicious accounts and have shut down the installs to ensure that no further agents can be installed. The Syncro platform itself was not compromised but rather a malicious actor posing as an MSP that created this account and then used it for nefarious purposes." - A Syncro spokesperson Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

In a very recent and well-targeted phishing attempt, scammers tried to get hold of the 1Password credentials belonging to a Malwarebytes’ employee. Stealing someone’s 1Password login would be like hitting the jackpot for cybercriminals, because they potentially export all the saved logins the target stored in the password manager. The phishing email looked like this: “Your 1Password account has been compromised Unfortunately, Watchtower has detected that your 1Password account password has been found in a data breach. This password protects access to your entire vault. Take action immediately To keep your account secure, please take the following actions: – Change your 1Password account password – Enable two-factor authentication – Review your account activity Secure my account now If you need help securing your account, or have any questions, contact us. Our team is on hand to provide expert, one-on-one support.” While the email looks convincing enough, you can spot a few red flags. The sender’s address watchtower@eightninety[.]com does not belong to 1Password, which typically use the domain @1password.com . If you hover over the “Secure my account now” button you’ll notice that it points to: https://mandrillapp[.]com/track/click/30140187/onepass-word[.]com?p={long-identifier} Although 1Password’s Watchtower feature can send alerts about compromised passwords, it does so by checking its database of known data breaches and then notifying you directly within the 1Password app or through very specific emails about the breach—not by sending a generic message like this. Obviously, the onepass-word[.]com is a feeble attempt to make it look legitimate. I guess all the good typosquats were already taken or protected. What’s interesting is that the “Contact us” link goes to the legitimate support.1password.com, although it also flows through a redirect through mandrillapp. Mandrillapp is a transactional email API and delivery service provided by Mailchimp. It enables organizations to send automated, event-driven emails like order confirmations, password resets, and shipping notifications. Mandrill also provides delivery tracking and statistics to their customers. What the scammers may not have realized is that Mandrillapp doesn’t forward people to known phishing websites. Shortly after the emails went out on October 2, the domain was already classified as a phishing site by several vendors. By October 3, anyone that clicked the button would end up viewing an error message on mandrillapp[.]com saying bad url - reference number: {23 character string}. But early birds would have seen this form: Anyone who fell for this scam would have sent their 1Password credentials straight to the phishing crew. On September 25, 2025, Hoax-Slayer reported about a very similar phishing expedition. This might indicate that this was the first—and probably is not the last—attempt, so be warned. With the key to your password vault, cybercriminals could take over all your important accounts and potentially steal your identity, so be very careful about where and when you use these credentials. Our advice: Do not click any links or buttons in an unsolicited email Do not provide any of your 1Password credentials or personal information. If you are concerned about your 1Password account, go directly to the official 1Password website or app and check your account status there. Use up-to-date real-time protection which includes a web protection module. Indicators of compromise (IOCs) Email address: watchtower@eightninety[.]com Domain Phishing website: onepass-word[.]com Let’s face it, an incognito window can only do so much. Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.