A hacker group tried to hijack 900\,000 WordPress sites over the last week