The phishing scheme used a web of over 500 fraudulent websites to extract key information from NFT users during the minting process.