The attacker then uses the compromised account to send crypto-themed phishing spam to the extracted mailing lists with alerts that prompt the recipient's action, like 'Coinbase is transitioning to ...