Fake LastPass app removed from App Store

LastPass is warning about a fake app that mimics its own app and has been found in the Apple App Store. The malicious app is likely created to steal credentials users'

The fake app used a similar name and icon to the authentic LastPass app. Even the red-themed interface attempted to mimic the authentic design.

However, the fake app's name was "LassPass" instead of "LastPass" and the publisher was listed as "Parvati Patel." Additionally, there was only one rating and only four reviews.

See also: Google: Tests sideloading of apps that request "dangerous permissions"

All of this evidence suggests that this is a scam, but someone who is not as observant or unaware of safe app downloading practices may fall into the trap.

It is important to be careful, as apps like LastPass store very sensitive information, such as authentication secrets and credentials (username/email and password). Therefore, LassPass was likely a phishing app aimed at stealing these details.

LastPass warned about the existence of this application through a notice on its website.

“We have included the URL for the fraudulent app as well as the link to our legitimate app so that customers can verify that they are downloading the correct LastPass app for themselves until the fraudulent app is removed,” LastPass’s notice said.

“Rest assured, LastPass is actively working to remove this app as soon as possible and will continue to monitor for fraudulent clones of our apps and/or violations of our intellectual property.“.

Indeed, it has been confirmed that the fake LastPass app has been removed from the Apple App Store, while its developer has also been removed from the Apple Developer Program.

See also: Pirated apps infect macOS systems with malware

The entry of such an application into the Apple App Store is not common, as the company implements very strict controlsto ensure that its app store meets high standards of privacy, security, and content.

This process involves automated and manual checks to ensure developers. However, this fake LastPass app was accepted.

When Apple becomes aware of an app that violates its policies, it usually acts quickly to remove it from the App Store and ban the developer. That's what it did in this case.

The same developer has another app on the App Store that appears legitimate, so the possibility that account by malicious actors cannot be ruled out.

If you have installed the fake LastPass app, you should remove it immediately and change your password at lastpass.com. You will also need to reset all passwords stored in your LastPass vault.

See also: Pirated macOS apps drain users' wallets

What are the steps to safely download an app?

The above shows that it is important to be careful before downloading an app. Only download apps from trusted sources, such as the Google Play Store or the Apple App Store, which have strict security checks. As we have seen, a malicious app can still get through there, but the chances are significantly lower.

Additionally, you should always check the ratings and comments of other users before downloading an app. This can help you avoid apps that have negative reviews or that appear to contain malware. In the case of LastPass, the reviews indicated that something was wrong with the app.

It's also important to check the permissions an app requests before installing it. If an app asks for access to personal information that doesn't seem necessary for it to function, it's best to avoid installing it.

Finally, it's always a good idea to keep your device's operating system and apps up to date. Updates often include security that can protect your device from new threats.

source: www.bleepingcomputer.com