[advisedwang]

I suppose you could phish people into leaking the master password

[pcthrowaway]

Or inject malicious code into the apps/extensions to get users to submit their master passwords

[eurasiantiger]

Maybe sneak in an altered copy of the LastPass app by offering it as a security update by email.