We are facing a problem with images attached by some users. They are linking to an image / directory which is password protected.

Due to this a plain http auth is shown, asking the user for entering his username + password, they are trying to phish some accounts of our community.

Is there a way to fix this?

Yes, by editing the post/posts to remove the image references and then banning or otherwise "punishing" the offenders (assuming you believe it was malicious intent).