Last week, LastPass users received email notifications that account logins were attempted from unrecognized locations in order to gain access to their cloud-hosted password vaults. Users reporting that their master passwords were compromised and that despite changing their master passwords, additional email notifications were received regarding the new ones. Nikolett Bacso-Albaum, LogMeIn Global PR/AR Senior Director, confirmed to BleepingComputer that LastPass determined this activity to be “related to fairly common bot-related activity, in which a malicious or bad actor attempts to access user accounts (in this case, LastPass) using email addresses and passwords obtained from third-party breaches related to other unaffiliated services” (aka credential stuffing). Bacso-Albaum also stated that there is currently no evidence that the accounts were successfully logged into from the unrecognizable locations or that LastPass was compromised by an unauthorized actor. However, Bob Diachenko, a security researcher, claimed to have identified “thousands of LastPass credentials while going through Redline Stealer malware logs” and 441,000 account credentials exfiltrated by the RedLine malware were added to the HaveIBeenPwned platform late last week. RedLine is the most commonly utilized data-stealing malware currently and targets various types of sensitive information, such as autocomplete information, credentials, credit cards, cryptocurrency wallets, etc. After this speculation was publicized, LastPass VP of Product Management Dan DeMichele told BleepingComputer that there is presently no indication that “user’s LastPass credentials were harvested by malware, rogue browser extensions or phishing campaigns” and confirmed that “at no time does LastPass store, have knowledge of, or have access to a users’ Master Password(s)” due to their “zero-knowledge security model”. DeMichele also revealed that some notifications were sent in error.