Last night, researchers at Malwarebytes noticed strange behavior on sites like Last.fm, The Times of Israel and The Jerusalem Post. Ads on the sites were being unusually aggressive, setting off anti-virus warnings and raising flags in a number of Malwarebytes systems. After some digging, researcher Jerome Segura realized the problem was coming from Google’s DoubleClick ad network and the popular Zedo ad agency. Together, they were serving up malicious ads designed to spread the recently identified Zemot malware. A Google representative has confirmed the breach, saying “our team is aware of this and has taken steps to shut this down.” Malware served over ad networks (or “malvertising”) is nothing new, but this incident is notable because of the unusually broad reach of the attack. “It was active but not too visible for a number of weeks until we started seeing popular sites getting flagged in our honeypots,” Segura says.