How one fake Google ad can silently steal your Mac’s passwords