LastPass enters VPN market with password manager bundle. LastPass has launched a consumer VPN bundled with its password manager under a new LastPass Plus subscription, initially available through a standalone Windows desktop app. The VPN service launched today offers unlimited VPN traffic, support for up to 10 devices, and access to more than 100 virtual locations across over 85 countries. LastPass lists the combined Premium password manager and VPN package at $84 annually, equivalent to $7 per month. The VPN is currently exclusive to LastPass Plus and is not available as a standalone subscription. The company is pitching the bundle to existing customers who already pay for a separate VPN, aiming to consolidate subscriptions and account management. Founded in 2008 and headquartered in Boston, LastPass provides password and passkey management for consumers and businesses. The company says its services are used by millions of people and more than 100,000 organizations. Separate app, same account. Customers access the VPN through a Windows application downloaded from the Microsoft Store, signing in with their existing LastPass account. LastPass plans to add support for iOS, Android, and macOS, but has not provided release dates for those platforms. The VPN encrypts users' internet connections, with LastPass positioning it as a privacy tool for browsing at home, traveling, and using public Wi-Fi. The company also states that it does not log browsing activity passing through its VPN servers. That no-logging commitment is a company claim, and we will be monitoring for the release of independent audit results on the VPN's logging practices, as well as details about which VPN protocols the service uses. LastPass says the VPN operates separately from the password vault, despite sharing an account and subscription, and leaves its zero-knowledge vault security model unchanged. Under that model, vault data is encrypted on users' devices, and LastPass does not know their master passwords. Security assurances. The expansion comes after LastPass's 2022 security incidents, in which attackers stole customer information and backups containing encrypted password vault data. Some vault fields, including website URLs, were unencrypted. In the launch announcement, LastPass says it has spent the past three years rebuilding its security foundation through a multi-million-dollar investment. It cites ISO 27001 and SOC 2 certifications, a dedicated threat intelligence team, and an increase to 600,000 PBKDF2-SHA256 iterations for strengthening password-derived keys. For customers considering Plus, the immediate limitation is platform support, as the VPN is currently available only on Windows. Users should review the service's privacy terms and device compatibility before replacing an existing VPN subscription.

The EDR was dead before the theft started. September 21, 2026 On 17 September 2026, LastPass's Threat Intelligence, Mitigation and Escalation team published joint research with Delphos Labs on an infostealer they track as Rapuncel. Everything factual below comes from their report and from BleepingComputer's write-up of it. RelayShield did not find this campaign and RelayShield is not claiming to have. One detail in it is worth more attention than it is getting. Before Rapuncel steals anything, it loads a kernel driver that carries a hardcoded list of 145 antivirus and EDR products, and terminates them. The driver is signed through Microsoft's Windows Hardware Compatibility Publisher chain. It ships as nvfsflt64.sys, presenting itself as an NVIDIA file system filter; researchers identified it as a renamed CcProtect.sys from a commercial encryption product. So the order of operations is: disable the detection layer, then steal. What that order means. Almost every control most organisations own is a detection control. It observes, it correlates, it alerts. All of them share one unexamined assumption: that they are running when the thing they detect happens. A kill list of 145 products is that assumption being attacked directly and at scale. It is not evasion in the usual sense, where malware tries to look boring enough to slip past. It is the security stack being switched off first, with a signature Windows trusts. And once it is off, the question "did we detect it?" has a fixed answer, and the answer is no. Not because the product was bad. Because it was not running. What is left is the only signal that survives the endpoint: the stolen material turning up somewhere else. What Rapuncel takes, and why the list matters. Per the same research, once the protections are down the stealer collects credentials from more than 25 browsers, data from around 30 cryptocurrency wallets, session credentials for Discord, Steam and Telegram, the contents of Windows Credential Manager, and screenshots. Read that list again for what it is not. It is not mostly passwords. * Session credentials for three messaging and gaming platforms. * Browser data, which in practice means cookies as much as saved logins. * Wallet data, which is not a credential you rotate at all. This is the distinction RelayShield keep coming back to, because it decides whether a response works. A password reset invalidates a password. It does not invalidate a session. An attacker holding a live session cookie does not need to log in, so there is nothing for a new password to stop, and no MFA prompt to satisfy either, because the session already satisfied it. The same is true one step further out. Rotating a key does not revoke a token. Changing a seed phrase is not a thing you can do. How it arrives, which is the ordinary part. Victims search for software, follow a result to a GitHub repository impersonating the real project, and download from it. The campaign impersonated at least 40 brands, including LastPass Authenticator itself, and the researchers date it to at least 13 August 2026. The downloads are ZIP archives inflated to as much as 148 MB, which is large enough to fall outside some scanning limits. The installer is a renamed copy of vsdbg.exe, Microsoft's Visual Studio debugger, with a malicious vsdbg.dll dropped beside it, so the attacker's code executes inside a signed Microsoft process. There is no exploit in that chain. A person searched, trusted a repository that looked right, and ran it. What RelayShield do about it, and what RelayShield do not. RelayShield is not an EDR and RelayShield would not have stopped this. A signed kernel driver terminating 145 security products is not something an API answers. Any vendor telling you otherwise this week is selling you something. What RelayShield work on is the half that is still observable after the endpoint stops reporting: whether the material that left is now in circulation. * POST /v1/metered/infostealer answers whether an email address appears in infostealer log dumps. Not whether it was in a breach years ago, which is a different and much older question, but whether a machine belonging to that person was logging keystrokes and hoovering browser stores. * POST /v1/metered/session-risk answers the question a password reset does not: whether a live session was taken. * POST /v1/wallet-risk and POST /v1/link-check are open, with no key, no card and no signup, capped per source IP rather than billed. The link check is the one that would have been useful in front of the download. And in the consumer product, the response for this specific shape is /sweep: close the forwarding rules, revoke the sessions, remove the rogue recovery options, and only then reset the password. Doing it in the other order leaves an attacker inside an account whose password has just been helpfully changed for them. The uncomfortable part. RelayShield collect from criminal marketplaces and infostealer log dumps, which means what RelayShield see is the output of campaigns like this one after they have already worked. RelayShield is not early to the infection. RelayShield is early to the consequence, which is a smaller claim and a true one. RelayShield do not quote a corpus headline, here or anywhere. Most of any vendor's total is ingested public feeds you already have, and the number that matters is what is in it that you could not find elsewhere. Ask RelayShield that instead. If you want the short version. The detection layer was off before the theft began, by design, with a Microsoft signature. Plan for the case where your detection did not fire, because that case is now a product feature of the malware. The plan is: know what left, revoke sessions before rotating passwords, and treat a wallet as unrecoverable rather than rotatable. Free checks, no account: forward a suspicious email to [email protected], or paste a link or a wallet address into the checker in Telegram.

LastPass enhancements improve visibility, governance, and control. LastPass announced a series of strategic product innovations, customer experience enhancements, and industry milestones. These advancements reflect the company's continued focus on providing practical tools to protect access and identity in an increasingly AI-driven threat landscape. Highlights include new tools that simplify access management, enhancements that help customers get more value from LastPass, and milestones that demonstrate the company's continued growth and industry leadership. The LastPass commitment to visibility, governance, and control comes at a pivotal moment. According to IBM's 2026 Cost of a Data Breach Report, the average data breach now costs organizations $4.99 million, a record high and 12% increase over last year. The report also found AI-driven attacks increased 56%, adding an average of $1 million to breach costs, and 92% of organizations experiencing AI-related breaches lacked appropriate AI access controls. "As threat actors continue to automate and accelerate their attack tactics, strong identity, credential, and access management have become foundational security requirements, particularly for small and midsize businesses with limited resources," said Karim Toubba, CEO of LastPass. "To address these evolving challenges, LastPass is dedicated to delivering the innovations that help organizations and individuals reduce risk while making security easier to manage." LastPass introduced numerous enhancements across SaaS Monitoring and SaaS Protect within its flagship Business Max offering to help businesses navigate increasingly complex SaaS landscapes with greater visibility, oversight, and confidence. This includes: Always-on SaaS Monitoring: Persistent Monitoring maintains continuous visibility through a permanent connection to the LastPass browser extension, ensuring monitoring remains active even when users are signed out of LastPass. More flexible SaaS Protect controls: Expanded usage rules allow administrators to create more granular policies for specific users or groups, enabling organizations to apply security controls based on their unique needs. Together, these enhancements help organizations accelerate adoption, reduce manual workloads, improve security coverage, and strengthen policy enforcement by giving administrators more control over how and where security policies are applied. As of July, all enhancements have been fully released, including Persistent Monitoring across all browser extensions. LastPass launches Mobile Smart Scanner. With the launch of Mobile Smart Scanner, LastPass empowers businesses and individuals across all product offerings to: * Use the LastPass Mobile app to scan passwords from printed lists, screenshots, handwritten notes, and other physical sources and turn them directly into editable, autofill-ready credentials. * Reduce manual data entry, saving time and minimizing errors. * Simplify password management, keeping credentials secure in encrypted vaults rather than vulnerable on notes or memory. LastPass transforms user experience with enhanced, high-efficiency community platform. Building on its commitment to customer success, LastPass introduced a redesigned Community experience that streamlines how customers discover trusted information, connect with peers, and get more value from the platform. With a more intuitive interface and expanded self-service resources, including topical portals and AI-powered search, the enhanced LastPass Community helps users across all product offerings quickly access the knowledge they need to strengthen security and resolve questions faster. The LastPass Community is part of a broader, integrated self-service strategy designed to meet customers at their point of need - whether that's through the company's branded community or across social platforms like Reddit and LinkedIn. LastPass security and UX improvements. Security and compliance milestone. For the second consecutive year, LastPass successfully completed independent SOC 2 and ISO 27001/27701 audits with zero findings, reinforcing the company's commitment to security and providing customers with assurance that LastPass controls meet globally recognized standards. Dark web monitoring (DWM) auto-enrollment. LastPass has enacted a phased rollout to automatically enroll all consumer accounts in DWM, transitioning the service from a historically opt-in experience to a more proactive protection model. This update helps ensure more customers can benefit from credential exposure monitoring without requiring additional setup, helping users identify potential risks and take action to protect their accounts. Dark web monitoring from LastPass consistently checks user information against databases of compromised credentials, and issues immediate alerts if any personal data is found on dark web sites. With 24/7 monitoring, users can take near real-time action, such as changing their password, to protect themselves. LastPass DWM also notifies users of potential threats like weak passwords, helping them stay ahead of threat actors. Admin console consolidation. LastPass officially completed the transition from its Legacy Admin Console to a single Unified Admin Console, creating a more consistent and streamlined experience for administrators across business offerings. By consolidating management capabilities into one centralized platform, LastPass enables faster product improvements while simplifying how admins manage users, security controls, and access policies. Simplified organization-wide onboarding for all business customers. A new company-wide sign-up link allows Teams, Business, and Business Max customers to onboard their entire organization to LastPass through a single shareable link, reducing administrative effort and accelerating deployment. More about