A combination of a common Internet scam, weak passwords and a since-fixed vulnerability in Apple’s photo backup service could be to blame.