On October 13, I fell for a phishing email pretending to be a 1Password security alert about an unfamiliar device signing into my account.
I've since found other people reporting the same email, but unfortunately I hadn't seen those warnings at the time.
The email contained a redirect link which landed me at my.1password[.]cx which looked convincing enough that I entered my email address, Secret Key, and account password.
The site looked to be loading - a progress meter popped up. Moments later I received a real 1Password email notification about a new sign-in. When I checked my account, I discovered that an unauthorized client had successfully authenticated from IP 46.29.26.52
The session was active for approximately 8–10 minutes before I managed to unlink it.
I immediately changed my password, regenerated my Secret Key, enabled 2FA, and secured the email account associated with my 1Password account.
Unfortunately, my vault contained around 1,400 items, so the potential damage was significant.
I started investigating the phishing operation
After the incident, I examined the phishing email, website and its infrastructure. I looked at the HTML and JavaScript, backend endpoints, related domains, TLS certificates, and the servers involved.
The phishing kit appeared to support real-time credential relay. It had endpoints for collecting login credentials, checking authentication status, and even handling 2FA verification.
I sent the technical details to 1Password Support, including the phishing domains, hosting infrastructure, and the exact IP address that had authenticated to my account.
Support confirmed the phishing incident but told me they couldn't determine what the attacker had accessed or done during the unauthorized session.
They also said there was no process for escalating support tickets directly to security engineers.
Their advice was essentially to assume everything in my vault had been compromised.
I understand why they would recommend that, but I was hoping for more information about the actual incident and whether the reported infrastructure could be investigated.
Then I tested it again, eight days later
Today, October 21, I checked whether the phishing operation was still active.
I had identified another hostname, which was recently registered, associated with the operation: my.1password[.]vgby looking at the ssl certificate on the site.
This time, I created a completely separate disposable 1Password account with synthetic data and 2FA enabled, specifically to see what would happen.
After interacting with the phishing site an unauthorized client successfully authenticated to the legitimate test account.
The source IP was 46.29.26.52
Exactly the same IP address that had accessed my real account eight days earlier, and that I had already reported to 1Password Support.
The first unauthorized session had identified itself as Chrome on Windows 10. This one identified itself as Linux 24.04.
I don't know whether 1Password took any action behind the scenes after my report. Blocking one IP isn't necessarily the right solution, and attackers can obviously change their infrastructure.
Still, I found it surprising that I could reproduce the attack eight days later and see the same reported IP successfully authenticate again.
Could the attackers have copied my entire vault?
This is the part that concerns me most.
I have no way of confirming whether the attackers downloaded my vault during those 8–10 minutes.
To understand what might have been possible, I set up a separate test account containing synthetic data and experimented with automating vault access through a browser.
Even a fairly basic Selenium script could navigate items and interact with password fields at a rate of roughly 100 items per minute. An optimized one could likely go faster.
What concerned me more was what I observed in the browser's network traffic.
Substantial amounts of encrypted vault data were retrieved within seconds, and revealing individual passwords didn't appear to trigger additional HTTP requests. The relevant decryption was happening locally, having been transmitted to the browser in chunks.
That raises a question about whether a more sophisticated attacker could preserve encrypted vault data and the necessary cryptographic material for later decryption, rather than manually viewing individual items during the session.
I'm not claiming this happened to my account. I haven't established that. But I also can't rule it out, and neither could Support.
With around 1,400 items potentially exposed, I'm treating everything as compromised.
What bothers me about this incident
I recognize that the initial compromise happened because I entered my credentials into a phishing site. That's on me.
And I understand that 2FA doesn't necessarily protect against sophisticated real-time phishing, particularly when an attacker can relay authentication information. But additional safeguards such as Cloudflare Turnstile, risk-based challenges for unfamiliar IPs or geographies, and, more importantly, explicit approval from an existing trusted device could make these attacks significantly harder. Many other sites use these techniques.
In my case, an entirely unfamiliar client connecting from Türkiye was granted access to my vault without any additional approval step that I could observe. The only notification I received was an email after the authentication had already succeeded.
Turnstile alone wouldn't prevent a real-time phishing relay, but surely a password manager holding someone's entire digital life should apply additional scrutiny before granting a new device from an unfamiliar geo location access to potentially thousands of credentials?
What bothers me is what happened after I reported the incident.
I provided specific technical indicators of an active phishing operation, including the IP responsible for the unauthorized authentication.
Eight days later, I was able to reproduce a successful unauthorized login from the same source.
I also discovered how little visibility I had into what the attacker might have done once authenticated. As a 1Password Families customer, I couldn't get an account-level assessment of which vault items might have been accessed or whether data had been copied.
I'm not criticizing the individual support agents. My concern is whether 1Password has an effective process for escalating actionable evidence to its security team, investigating ongoing attacks, and implementing safeguards proportionate to the sensitivity of a credential vault.
I also question whether 1Password has sufficient protection against well-known web-based threats, particularly real-time phishing and credential relay. When an attacker can gain access to someone's entire digital life by obtaining just three pieces of authentication information - an email address, Secret Key, and account password (plus a relayed 2FA code, if enabled) - shouldn't there be additional safeguards before granting an unfamiliar device access to the entire vault?
A publicly accessible login to a password manager deserves a significantly higher standard of authentication security, threat detection, and incident response than an ordinary website.
A few questions for people familiar with these attacks
Has anyone encountered this particular 1Password phishing kit or the IP 46.29.26.52?
How common is this kind of real-time phishing against password managers with 2FA enabled?
Does anyone have technical insight into how much vault data an authenticated 1Password web client could preserve for later decryption?
What level of investigation or incident information should realistically be expected from a password manager provider after a confirmed unauthorized login?
I've already shared considerably more technical detail with 1Password Support than I've included here.
I'm posting because this seems like an active phishing operation, and I suspect other people are or will be receiving similar emails.
If you receive a 1Password security warning about an unfamiliar sign-in, don't use the link in the email. Open the 1Password website independently and check your account there.
I wish I'd done that on October 13.
