Very simply, I have a password stored for "login.example.com". LastPass knows that companies like to change URLs - so next week it might be "userlogin.example.

Very simply, I have a password stored for "login.example.com". LastPass knows that companies like to change URLs - so next week it might be "userlogin.example.com" or "secure.example.com/login" or "www2.uk.vpn1.example.com" etc. Essentially, LastPass made the mistake of writing code which said "If you see `example.com` anywhere in the URL - assume that you're on the right site. LastPass will allow you to automatically fill in the username and password as soon as you visit a site (I think this is an optional feature). An attacker convinces you to visit "badsite.wtf/@example.com/". LastPass sees the "example.com" and autofills the password field. The site has some JavaScript to detect the filled in details - and steals them.