The article links to lastpass multifactor [0] though. I agree that having multifactor enabled on the site the credentials were stolen for would block this attack.

[0] https://helpdesk.lastpass.com/multifactor-authentication-opt...