Threat actors utilize automated scripts to merge leaked databases and cross-reference victim email addresses for phishing campaigns