Fireball (software)
Malware has the ability of running any code on victim computers, such as downloading an arbitrary file and hijacking and manipulating infected user's web traffic in order to generate advertisement revenue. It installs plugins and additional configurations to boost its advertisements, and has potential to turn into a distributor for any additional malware. Malware is spread mostly via bundling. It is installed on a victim's machine alongside a wanted program, often without the user’s consent. Digital marketing agency Rafotech has been indicated as producer of the software. The same company has been accused to host fake search engines, which redirect the queries to yahoo.com or google.com. The fake search engines include tracking pixels used to collect private information from users. Fireball manipulates the infected browsers and turn their default search engines and home pages into the above mentioned fake search engines, which enable the software to spy on users of the infected browsers.
MindGeek
It was reported in April 2013 that visitors to some of the world's most popular (by Alexa rank) pornography sites risked malware being installed on their machines by malicious third party advertisements. The claims were made by security researcher Conrad Longmore, who writes a blog on malware, spam and scams. Longmore's figures were collected using Google Safe Browsing Diagnostics, which looks for harmful content on websites, and the statistics for two sites; xHamster and Pornhub were published by BBC News. The BBC article stated that based on Longmore's research, 5% of pages on xHamster (which has never been owned by Mindgeek / Manwin), and 12.7% of pages on Pornhub incorporated malvertising. MindGeek (still known as Manwin at the time) said in a statement that their own figures showed that 0.003% of the advertisements they served over the period that Longmore's data was collected contained malware, and they said that the advertisements they serve are monitored for malware and malware is immediately removed.