A Betterment employee was tricked into sharing login credentials, which were then used to send phishing emails.