A global operation called EMERALDWHALE has resulted in the theft of more than 15,000 cloud service credentials.