Australian superannuation funds have been hit by attackers using stolen credentials to access members' accounts.