Phishing attack could steal LastPass password manager details

Hackers can simulate a login dialogue so closely that even careful users might simply give them their username, password and even their two-factor key

A security researcher has released a tool that can steal the login details and two-factor authentication key for the popular LastPass password manager, leaving users potentially exposed.

LastPass, like many other password managers, stores user's passwords in the cloud in an encrypted vault protected by a single username and password. The vault can also be protected using various forms of two-factor authentication.