The worst (best) part is that it was only caught when they did because the attacker got greedy and tried to double dip. Would be interesting to find out how they turned a phishing attack into that.