The group also #operates several spoof sites for the targeted #credential harvesting.