A phishing kit targeting both the login information and also the API key for Vonage API users (previously Nexmo). The stolen API can then be used to send and receive SMS, or even calls, from a large selection of clean numbers.