A new security research has revealed that the extensively used LastPass password manager can apparently be compromised by attackers with the help of a fairly simple phishing attack.

Highlighting the findings of the research during a presentation at the Shmoocon conference on Saturday, Sean Cassidy -- CTO of cloud-based cybersecurity firm Praesidio Inc. -- said that attackers can seemingly spoof the notifications displayed by LastPass version 4.0 in a browser window.

As a result, LastPass users can be hoodwinked into revealing their login credentials and even snatching a one-time passcode.

Disclosing that LastPass has been notified about the security issues, Cassidy said in a recent blog post that LastPass has claimed that it has made improvements which have evidently made it difficult for attackers to pull off the phishing attack without a user’s knowledge.

Meanwhile, to explain how alerts from LastPass can be spoofed by an attacker, and how LastPass users can eventually be tricked into divulging their login credentials, Cassidy released a tool on GitHub.

Asserting that the findings of the research highlight the need for software to be more resistant to phishing attacks, Cassidy said in the blog post: "Many responses to the phishing problem are 'train the users,' as if it was their fault that they were phished. Training is not effective at combating LostPass because there is little to no difference in what is shown to the user."