Thousands of WordPress sites hijacked to spread Windows and Mac malware