Twitter says large-scale hack due to 'phone spear-phishing'