I am randomly getting redirected to a page that looks very suspicious, especially the URL that sends the base64 encoded payload. It usually happens when I click a news link, usually a local news site. So I thought the news site was possibly compromised. Recently though, it happened when I clicked on an article on msn.com. So now I think may phone my be the problem. It is a Samsung Galaxy S5, fully updated.
I only copied the URL once, so I am not sure if it changes, but here is the one I captured (DON'T GO TO THIS):
I also captured 3 screenshots of the page:
- The initial popup
- The page behind the popup
- The page behind the popup, scrolled down
The last screenshot is updated in real time with fake posts.
Does anyone know what this is or how to get rid of it?