North Korean hackers are now using phishing emails instead of their previous tactic of social media grooming, a research firm has found.