Two Russian hackers are being accused of running a phishing campaign to steal millions in more than 40 countries