Hacks like the one that took over the the AP's Twitter feed are usually caused by a response to a phishing email asking for account information.