LastPass reports an active phishing campaign using fake maintenance emails and spoofed domains to trick users into revealing their master passwords.