Glad to help.
It looks like they used again the PHISHING site steemconnect.xyz so I'm running again the script to fill it with thousands of fake credentials:
I'm also running another script to reply to all the phishing comments and put users on guard in case a new similar phishing wave hits.
UPDATE: enemy down, cease fire.
UPDATE: NEW WAVE being contrasted.