Yahoo Ad Server Compromise Recap

A malvertising campaign (Jan 1–3) abused Yahoo advertisements to serve malicious iFrames that redirected users to the Magnitude exploit kit; the activity generated ~21,000 transactions and delivered multiple malware families (Zbot, Andromeda, Dorkbot, Tinba, Necurs and various adware). Several compromised landing domains and many randomly generated EK hostnames are enumerated, along with a common hosting IP (193.169.245.78), and investigators halted the campaign after researchers and Yahoo intervened.