A web security firm has identified a widespread attack in which fake malicious advertisements, able to avoid content scanning, are seeking to infect users of popular websites.