Hacking group combines spear-phishing with mass malware campaign