Easy-to-exploit, one-click attack caught more than 100,000 users; additional variations may still be at large.
