Infected job search sites lead to identity theft for 1.6M