Dropbox users have been warned to stay alert after a new password attack has been confirmed — what you need to know and do.