The follow-on attack from August’s source-code breach could fuel future campaigns against LastPass customers.