Cyber-thieves used a classic phishing scheme to gain access to $4 million in carbon emissions credits last week, sending out emails to businesses asking them to log in to a fraudulent website posing as that of the German Emissions Trading Authority (DEHSt).