Probably should just link to the security researcher's post, since it's far more informative:

https://doublepulsar.com/adform-compromised-to-serve-crypto-...