A recent blog post by Will Dormann on CERT.org shows the prevalence of such applications lurking on every corner of the web: search engines results, software portals, popups, ads, etc. Some users are getting redirected to an exploit kit while at the same time receiving the same software update page. This is a very sneaky attack involving many actors with rotating domain names for harder identification. The domain likemagicbox.com illustrated in this case was registered on 2014-06-30, the same day it started being used in this malware campaign.”]
Source: https://blog.malwarebytes.com/threat-analysis/2014/07/a-cunning-way-to-deliver-malware/