Hackers used a backdoor through a little-known third-party app to steal LastPass customer data.