CryptoChameleon phishing: Hackers impersonate LastPass employees

LastPass is warning about a malicious campaign targeting users with CryptoChameleon phishing, which is related to cryptocurrency theft.

See also: Fake LastPass app removed from App Store

CryptoChameleon is an advanced phishing kit, detected earlier this year, targeting Federal Communications Commission (FCC) employees using customized Okta single sign-on (SSO) pages .

According to researchers at mobile security firm Lookout, campaigns using this phishing kit also targeted cryptocurrency platforms Binance, Coinbase, Kraken, and Gemini, using pages impersonating Okta, Gmail, iCloud, Outlook, Twitter, Yahoo, and AOL.

During its investigations, LastPass discovered that its service was recently added to the CryptoChameleon phishing kit and hosts a phishing website in the “help-lastpass[.]com” domain.

Hackers combine several social engineering techniques, including contacting the potential victim and impersonating LastPass employees who are trying to help secure the account after unauthorized access.

See also: LastPass: Enforces the use of 12-character master passwords

Here are the LastPass tactics observed in the CryptoChameleon phishing campaign:

• Victims receive a call from an 888 number claiming unauthorized access to their LastPass account and are asked to allow or block access by pressing “1” or “2”.
• If they choose to block access, they are told they will receive another call to resolve the issue.
• A second call comes from a fake number, where the caller, impersonating a LastPass employee, sends a phishing email from “support@lastpass” with a link to the fake LastPass website.
• Entering the master password on this website allows the attacker to change account settings and lock out the legitimate user.
• The malicious website is now offline, but it is very likely that other campaigns will follow and the threat actors will rely on new domains.

Users of the popular password management service are advised to be on the lookout for suspicious phone calls, messages, or emails claiming to be from LastPass and requesting immediate action, as they are likely the result of CryptoChameleon phishing.

Some indicators of suspicious communication from this campaign include emails with the subject line “We’re here for you” and the use of a URL shortening service for links in the message. Users should report these attempts to LastPass at abuse@lastpass.com.

See also: LastPass: Hackers impersonated CEO via deepfake to trick employee

Regardless of the service, the master password should not be shared with anyone, as it is the key to all your sensitive information .

How can one protect themselves from phishing attacks?

To protect yourself from phishing attacks, such as CryptoChameleon via LastPass, first of all, you should be careful with the emails you receive. Many times, phishing emails try to imitate official communications from well-known companies, but often contain spelling mistakes or strange email addresses. In addition, you should avoid clicking on suspicious links or downloading files from unknown senders. Even if the link seems to lead to a well-known website, it can be a trap to steal your information. It is also important to use up-to-date security software, which can protect you from malware and viruses that can be installed on your computer through phishing attacks. Finally, you should always check the URL of the websites you visit. If it does not start with 'https', then it is not secure and you should not enter any personal information.

Source: bleepingcomputer