Malicious app tried to impersonate LastPass and was distributed on the App Store

An app pretending to be a LastPass password manager has been removed from the App Store. The program was listed with its original service branding in an attempt to trick users and obtain downloads.

It was stated that the project was written by developer Parvati Patel. and was not published by LogMeIn, the original publisher of LastPass. There were a few grammatical errors in the app description as well.

Although there are many signs that it is a fake app, the fake LastPass has found a place in the App Store catalog, indicating that there are still holes in Apple’s review system.

It’s unclear whether the program was removed by Apple or deleted by the developer itself, but it was noticed by the LastPass team. The service warned users in an official blog.

“The app in question is called ‘LassPass Password Manager’ and lists Parvati Patel as the developer. The app attempts to copy our branding and user interface, but close inspection of the posted screenshots reveals typos and other indications that the app is fraudulent.” said Mike Kosak, LastPass senior intelligence analyst.

With the publication, the company tried to draw attention to the problem and prevent confusion and loss of personal data. In the same post, the company added a direct link to the fake and real app on the App Store so consumers can check for differences.

According to tracking service Appfigures, the impostor was released on January 21 of this year; hence it was available for at least a week. It’s unclear how many times it was downloaded.

How do you protect yourself?

This App Store obviousness reinforces this: No app store is immune to fraudsters, even in more closed ecosystems like Apple’s. It is important to make sure that the app found is genuine and truly delivers what it promises.

To do this, you can check basic elements like name, developer, reviews, number of downloads, number of prints, and other extra data available on the app page.