Researchers have discovered a highly sophisticated phishing campaign in which 42,000 phishing domains have been used to spread malware.