Fox: Malicious browser extensions caught spying on 2 million users