The hackers used spearfishing messages and installed malicious software to spy on users and steal data.