I've had an unexpected redirect from a hacked Wordpress site in the past. One of the reasons why I will never go without an abuse blocker + NoScript on work computers. I had been trialing going without at the start of that job and lasted a few months but that incident permanently removed any latent guilt.