A sneaky, wide-scale IAB operation uses a malicious traffic distribution system (TDS) to redirect visitors of trusted websites to ones that deliver malware.
DriveSurge Hijacks Thousands of Sites for ClickFix, FakeUpdate Attacks
Summary + source link. No paywalls, no tracking.