An investigation into a phishing campaign led researchers to a sprawling underground store for stolen accounts and criminal activity.