LastPass in 2FA lock down after 'fessing up to phishing attack

Password vault-plundering phishing bait lands on Github

Shmoocon Cloud castle for passwords LastPass has introduced mandatory sign in requirements for all new devices after security researcher Sean Cassidy dropped code allowing criminals to plunder vaults with mirror-perfect phishing attacks."