[sloshnmosh]

The software being used to push this malware is from Propeller ads and more recently AdMaven but is protected by Russian DDoS services.

[easrng]

Also AdFly does it too. For an example, go to https://firfox.com on Android. Depending on the campaigns active at the moment, you'll probably get pages trying to get you to enable push and or download VPNs or "antivirus" apps. (Especially Norton) On Windows Firefox, you sometimes get the "Your computer has a virus!!! Call our number!!!" sites too.