Cyberattackers are using a new phishing & malware campaign to target Xero online accounting software customers, according to Chicago-based MSSP Trustwave.