A campaign stemming from pirate streaming sites used malvertising redirector URLs to generate revenue, and infected almost a million devices.