{"success":true,"data":{"id":"onepassword-emergency-kit-phish","label":"Fake 1Password Emergency Kit reset or Secret Key recovery lure targeting password-manager vault access from non-1password.com sender","description":"Fake 1Password Emergency Kit reset or Secret Key recovery lure from a non-1password.com sender. 1Password is a category leader with 150,000+ business customers and millions of individual users. The Emergency Kit is a PDF containing the account's Secret Key (required for all device enrollments) and is the single most critical recovery artifact in the 1Password security model — without it, account recovery is impossible. Attackers send fake \"Your 1Password Emergency Kit has been reset by an administrator — download your new Emergency Kit immediately\" or \"Your Secret Key has been flagged for security reset — complete account recovery within 48 hours\" emails. Victims who click are taken to a pixel-perfect 1Password phishing page that harvests both the Master Password and Secret Key, giving the attacker full vault access. The signal fires when: (1) body references 1Password brand AND (2) Emergency Kit, Secret Key, vault recovery, or account recovery action is present AND (3) sender is NOT 1password.com or agilebits.com AND (4) no List-Unsubscribe or In-Reply-To. Source: GC1 R14 council #3; SpyCloud 1Password phishing kit report Q1 2026.","tier":"danger","category":"phishing","isThin":false}}