Millions of web surfers are being targeted by a single malvertising group