Recipients who click on links in the emails are redirected to a fake login page designed to steal email addresses and passwords.