I feel like this sounds more like a zero-day exploit being used to target the LastPass login servers.