Campaign that steals email has targeted at least 10,000 organizations since October.