Operating system vulnerability exploited in email hacking scam