A large malvertising campaign is currently targeting German users on some popular web sites such as eBay.de or T-Online.de. A rogue actor has been successful in gaining the trust from reputable ad networks including German ad-serving technology platform MP New Media. We decided to nickname this campaign kampagnen which is German for campaigns based on a unique identifier we saw being used in each attack: kampagnen=30. We spotted two bogus ad servers which bear the same structure that was inspired by the legitimate German platform they were abusing.”]