An advert for a review site called SatTvPro.com via Google AdWords appeared on Comcasts search results page. When people clicked on the ad, it launched the review site (running an outdated version of the Joomla CMS) but also silently loaded a series of redirects leading to the Nuclear exploit kit. An additional phishing website designed to look like the Xfinity portal would immediately display a warning claiming (quite rightly) that their computers may have been breached. This is the first attack we have seen which combines malvertising, exploit kit, phishing and tech support scam.”]