On January 23rd, we published a detailed report in collaboration with Malwarebytes concerning a prolific and persistent malvertiser that we named VeryMal:

https://blog.confiant.com/shlayer-purveyor-verymal-renounces-steganography-in-favor-of-google-firebase-as-malvertisers-shift-3a6119ecba24