Talos researchers noticed a drastic uptick in Angler Exploit Kit activity last week. The recent activity caught our attention due to a change to the URL structure of the landing pages. This type of change doesnt occur often and was coupled with some other interesting tidbits including how the HTTP 302 cushioning has evolved. During research Talos identified several active Angler campaigns delivering different payloads. The first campaign was delivering Cryptowall, which will be covered in detail here. The second delivered Bedep with click fraud and illustrates the variety with which Angler can be used.”]
Source: https://blog.talosintelligence.com/2015/06/angler-ek-more-obfuscation-fake.html