LastPass is warning users about an active phishing campaign that began around January 19, 2026. The attackers are impersonating LastPass and sending fake maintenance emails to trick users into revealing their master passwords. The phishing emails claim there is upcoming maintenance and urgently request users to create a local backup of their password vaults within 24 hours. This is an active threat targeting LastPass users specifically to compromise their master passwords and potentially gain access to all stored credentials.