To date . . .
. . not a one of them has any idea. Some who have picked them up are rather conservative in their browsing habits.
Legit servers are increasingly being invaded and compromised - maybe that's where they encounter them.
Since I do a lot of searching, every few days I click on a link, and instead of the site I get a "spyware checker" that pretends to have started scanning my disks for infections, putting up very Windows-like messages and progress bar. Of course the "Cancel" button doesn't work. Of course the "checker" also doesn't know I'm running OS/2.
It's probably things like that that inject the infections.
