Emails purporting to be an update to terms of service for GitHub and CircleCI instead attempt to harvest user credentials.