New 'scareware' attack hits 2.8 million victims, pretending to lock them out of your browser — here’s how you can stay safe