trajcek

Thanks for writing this up! After reading LastPass' very vague response, they did not inspire confidence for me to stick around as a paying customer.

I am unsure if this is too small of a compromise for them to be able to a) care or b) spend resources on investigating or that they just don't know what's happening.

+1 on uBlock Origin, but I think that's just a too common of an extension rather than the cause.

My master password was specifically for LastPass and it's a quite complex non-English language non-dictionary variant. There is no way that it's due to another breach or that it's a dictionary attack.

Honestly after the scare it just seemed stupid that I chose LastPass' own MFA for my LastPass account. Also if they really did get exploited, no idea what it means for their MFA solution.

Is this all today? Also did you check account history on your LastPass before asking for account deletion?

"Someone just used your master password to try to log in to your account from a device or location we didn't recognize. LastPass blocked this attempt, but you should take a closer look."

Could be... I haven't rotated my password in a while. Could you link me to more info about the LastPass compromise that you mentioned?

p.s. My master password is definitely not dictionary material, and it's not used anywhere else, so I am 100% sure it's not a bruteforce / phishing attempt.

Just happened to me one hour ago and got scared shitless.

  Time Monday, December 27, 2021 at 3:50 PM EST
  Location UNITED STATES
  IP address 107.173.195.83

Actions taken, in this order:

  - Head to *Advanced Options* -> *View account history* to see if anything suspicious is going on (nothing so far)
  - Disable Lastpass MFA and use Google Authenticator (Authy)
  - *Account Settings* -> click on *Show Advanced Settings* -> *Destroy Sessions* (to see if anyone is actively logged in)
  - *Account Settings* -> click on *Show Advanced Settings* -> *Country Restriction* to my country only (luckily not in the US as the bot was)
  - Change Master Password

Also moments earlier:

  - Investigating all Mac processes
  - Disabled all Chrome extensions and deleted most (should have made a list)

Let's hope it's not as bad as it seems.

Edit#1 | Following IP addresses are reported in the thread so far:

  160.116.88.235
  160.116.231.145
  160.116.88.235
  107.173.195.83
  107.173.195.213
  154.202.117.78
  196.19.204.79