Supply-chain CAPTCHA attack hits over 100 car dealerships