Twitter users had their account credentials stolen in a massive, still ongoing phishing campaign.