Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks