The hackers abused legitimate platforms to run the credit card theft campaign.