Comment by eps

They pack malware code into an alpha channel of the ad image and then use inoccuous looking JS code (which happens to be delivered with the ad) to extract and execute it. This allows them to sneak their goods past the ad network review.

Neat, but not that impressive.