More information on the cyberattacks against Marks & Spencer (M&S) and Co-op has emerged, revealing that hackers deceived IT workers into resetting passwords.