Using a pretty basic “You need to re-register your account” email, a group of phishers managed to swipe carbon credit permits—basically, entitlements to produce greenhouse gas emissions above the cut-off level stipulated by cap-and-trade laws—from six companies. Wired reports the permits were worth more than $4 million. But what do you do with pilfered carbon credits? These thieves re-sold ’em, to buyers who apparently thought they were purchasing legit credits in a standard trade—companies that produce less than their allotted share of greenhouse gases can sell the excess allowance to others.