Hotmail users have been urged to change their password after the web-based email service was hit by a phishing attack.