Yahoo is warning users of potentially malicious activity on their accounts between 2015 and 2016.