The campaign was conducted by malicious hackers who sold the stolen credentials off, with much of the info being put to use ...