I think this is the research they're referring to:

http://devd.me/papers/pwdmgr-usenix14.pdf

(Note that this is a USENIX paper, which makes the "we let them publish it" comment sort of weird).

The bookmarklet attack isn't subtle; page 8 explains how they were able to set up a malicious site that could obtain Lastpass (say) Dropbox credentials.