Hackers have found a clever new way to abuse Rich Text Format (.RTF) files in phishing attacks, experts have warned.