News Password-stealing app downloaded 100,000 times — what to do now