Active Phishing Campaign Targeting LastPass & Bitwarden: Detection and Hardening

---
title: Potential Phishing Click - Browser Spawned by Mail Client
id: 8a2c3d12-4b5e-6a78-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects browser processes spawned directly by email clients, a common behavior when users click phishing links.
references:
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1566
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\outlook.exe'
      - '\thunderbird.exe'
      - '\winmail.exe'
  selection_child:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate users clicking links in newsletters
level: low
---
title: Connection to Potential Typosquatted Password Manager Domains
id: 9c3d4e23-5c6f-7b89-0c1d-2e3f4a5b6c7d
status: experimental
description: Detects network connections to domains containing password manager brand names but using unofficial TLDs or structures often used in phishing.
references:
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1056
logsource:
  category: network_connection
  product: windows
detection:
  selection_brand:
    DestinationHostname|contains:
      - 'lastpass'
      - 'bitwarden'
  filter_legit:
    DestinationHostname|endswith:
      - '.lastpass.com'
      - '.bitwarden.com'
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_brand and not filter_legit and not filter_internal
falsepositives:
  - Internal tools referencing vendor names
  - Legitimate partner reseller domains
level: high

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("lastpass", "bitwarden")
| where RemoteUrl !endswith ".lastpass.com" 
| where RemoteUrl !endswith ".bitwarden.com"
| where RemoteUrl !startswith "10." and RemoteUrl !startswith "192.168." and RemoteUrl !startswith "172.16."
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| summarize count() by RemoteUrl, DeviceName
| order by count_ desc

-- Hunt for connections to suspicious domains mimicking password managers
SELECT Fqdn, RemoteAddress, Pid, ProcessName, Username
FROM listen_sockets()
WHERE Fqdn =~ 'lastpass' 
   OR Fqdn =~ 'bitwarden'
   AND NOT Fqdn =~ '.lastpass.com$'
   AND NOT Fqdn =~ '.bitwarden.com$'

# Audit Password Manager Extensions for Tampering
# Official IDs LastPass: hdokiejnpimakedhajhdlcegeplioahd
# Official IDs Bitwarden: nngceckbapebfimnlniiiahkandclblb (Chrome), jbkfoedolllekgbhcbcoahefnbanhhlh (Edge)

$ChromePath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions"
$EdgePath = "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions"
$KnownIDs = @(
    "hdokiejnpimakedhajhdlcegeplioahd", # LastPass Chrome
    "nngceckbapebfimnlniiiahkandclblb", # Bitwarden Chrome
    "jbkfoedolllekgbhcbcoahefnbanhhlh"  # Bitwarden Edge
)

Write-Host "[+] Auditing Password Manager Extension Integrity..."

$Paths = @($ChromePath, $EdgePath)
foreach ($BasePath in $Paths) {
    if (Test-Path $BasePath) {
        Get-ChildItem $BasePath -Directory | ForEach-Object {
            $ExtID = $_.Name
            $VersionPath = "$($_.FullName)\*\manifest."
            $ManifestFile = Get-ChildItem $VersionPath -ErrorAction SilentlyContinue
            
            if ($ManifestFile) {
                try {
                    $Manifest = Get-Content $ManifestFile.FullName | ConvertFrom-Json
                    $Name = $Manifest.name
                    
                    # Check if it claims to be a target vendor
                    if ($Name -match "LastPass" -or $Name -match "Bitwarden") {
                        if ($KnownIDs -notcontains $ExtID) {
                            Write-Host "[!] ALERT: Suspicious Extension Found!" -ForegroundColor Red
                            Write-Host "    Name: $Name"
                            Write-Host "    ID:   $ExtID (Expected official ID not found)"
                            Write-Host "    Path: $($_.FullName)"
                        } else {
                            Write-Host "[+] Verified: $Name (ID: $ExtID)" -ForegroundColor Green
                        }
                    }
                } catch {
                    # Error reading manifest, likely corrupted or obfuscated
                    Write-Host "[?] Warning: Could not read manifest for $ExtID" -ForegroundColor Yellow
                }
            }
        }
    }
}
Write-Host "[+] Audit Complete."