A sophisticated and ongoing supply-chain attack operating for the past year has been stealing sensitive login credentials ...