So, is there a comprehensive list of affected sites anywhere? I've seen a short list of sites serving the malware, but I see no mention of whether this was distributed via any large-scale tube sites.
It was served through ad networks, the only version in the wild I've heard of was targetting a russian network
Yeah, I just wondered if any of these ad networks would be serving through any of the large-scale adult sites like pornhub, tube8, etc.
It was disguised as an ad, not served through ad networks. In other cases it was disguised as a file from a CDN.
If it was attempting to search the whole filesystem for interesting files to upload, I think that might be somewhat noticeable - at least for those who don't have an SSD, or have a HDD activity light in plain view. If some process on my system suddenly decides to scan the filesystem, I'd definitely notice the HDD seeking.