mSecure tells users: change passwords and reset 2FA, passkeys

mSecure just told customers to rotate everything—passwords, two‑factor authentication (2FA), even passkeys—after it spotted “suspicious activity” tied to the app. The notice landed November 3 under developer mSeven Software’s name. It doesn’t confirm a breach, but the guidance is blunt: act now.

Password managers are concentration points for your digital keys, so even a precautionary alert should trigger a measured but thorough response. Here’s what mSecure asked, what that means in practice, and how to communicate changes without creating more risk in inboxes.

What happened

On November 3, mSecure customers received an email from mSeven Software urging immediate security steps: change account passwords, reset 2FA, and remove passkeys. The company said it learned of “suspicious activity” linked to the app, without offering additional technical detail in the report from The Hacker News.

The call to rotate three separate elements—passwords, 2FA, and passkeys—signals a broad defensive reset rather than a single‑vector fix. That pattern typically aims to invalidate any credentials or authenticators that might be weakened by unknown activity.

The message was framed as an urgent protective step for the confidential information users store in mSecure. Even without a confirmed breach, the advice is to assume risk and move quickly to contain it.

The background

mSecure is a consumer password manager built by mSeven Software. By design, password managers centralize sensitive logins and notes behind a single account, which can include multiple authentication factors: a password, a time‑based one‑time code or push (2FA), and increasingly, passkeys.

Resetting your account password invalidates the most basic secret. The second step—resetting 2FA—means removing your current second factor and re‑enrolling it, which cuts off anyone who might have copied or registered an additional factor during suspicious activity.

Passkeys, which use public‑key cryptography and device or platform authenticators, are also on mSecure’s reset list. Removing and re‑adding them ensures that only fresh, trusted devices hold the private half of those keys. This also narrows any window where a compromised device could act as a valid authenticator.

From an email‑risk angle, password manager incidents often trigger opportunistic phishing. Attackers may mimic support notices to capture real credentials. We’ve reported how realistic login clones now capture multi‑factor and sessions as well in AI‑made login clones now grab MFA and sessions, too. That makes clear, specific guidance—and authenticated sender identity—critical when you email users about resets.

If you’re drafting customer communications, align your mail with DMARC (Domain‑based Message Authentication, Reporting, and Conformance) so providers can verify that messages about security come from you. Our practical walkthrough on staying visible during noisy security weeks is in Harden deliverability when security headlines spike, and more broadly under the Security hub.

What people are saying

The November 3 email from mSeven Software asked customers to “act now,” specifically to change passwords, reset two‑factor authentication, and remove passkeys, per The Hacker News. The notice attributed the request to “suspicious activity” linked to the app, offering no further technical indicators in the summarized report.

Security teams typically favor broad credential rotation when an event’s scope isn’t yet fully understood. Asking users to refresh all factors minimizes residual access that can linger when only a single authenticator is changed. It also reduces second‑guessing: if a factor could be affected, treat it as affected.

For everyday users, the most common failure is partial rotation—changing a password but leaving old 2FA enrollments or passkeys in place. The mSecure guidance closes that gap by listing all three. Done in order, this produces a clean slate for subsequent activity tracking.

Email teams should plan for a temporary spike in account‑related traffic. Attackers often exploit such windows with lookalike notices that riff on real events. In earlier coverage, we’ve shown how adversaries bypass strong logins with social and technical tricks—see the “walk‑around” problem in Passkeys won’t save you from bad recovery and session theft patterns in Huntress: Microsoft 365 token replay hit 79 orgs. That context is useful when setting user expectations about what your genuine emails will—and won’t—ask.

If you must distribute reset instructions by email, avoid links where possible. Point users to known bookmarks or your app directly. When links are unavoidable, add clear cues users can verify, keep language precise (list the exact actions: password change, 2FA re‑enrollment, passkey removal), and ensure the From domain is aligned with SPF, DKIM, and DMARC.

What happens next

Users should follow the order of operations implied by the advice: change the mSecure account password first, then reset 2FA, then remove and re‑add passkeys. Document what you changed and when, which helps support teams validate legitimate resets later.

Organizations should prep help desks for verification‑first workflows. Expect callers who saw the November 3 notice and need assistance. Train staff to confirm identity without shortcuts, since attackers may try to piggyback on the moment with persuasive pretexts.

Marketing and product teams should coordinate on a single, signed customer message. Keep scope factual—reference the November 3 advisory and the requested rotations—and minimize speculation. If you send to large lists, stage by segment to monitor deliverability and engagement patterns as the notice rolls out.

Finally, monitor for copycat spam. Blocklists often light up after security notices. Tighten brand monitoring for lookalike domains and be ready with a follow‑up that teaches users how to verify real messages from your domain if you see phishing attempts that imitate your wording.

mSecure hasn’t shared further technical detail in the cited report, so treat this as a precautionary rotate‑and‑watch phase. If the company publishes indicators or a root cause later, adjust your controls accordingly and audit the changes you made during this first pass.