I thought this was related to the reality show, but it looks like not.

I don't have anything interesting to add, but the infection was via advertisements it looks like. Until now my stance has been "I use an ad blocker generally, it's too much work to turn off for individual sites" while feeling bad about hurting non-abusive sites that relied on advertising to operate (YouTube?).

This made me realize though that there is no conscionable argument to ask people to disable ad blockers on your site, and I no longer feel bad about not disabling them. If you ask people to disable ad blockers, you are asking them to expose themselves to increased risk and you have a moral obligation to find an alternate way to fund operation (maybe there are human-vetted, js-free first-party served advertising networks...).

Thank god it is only used by 3rd world countries like Egypt, Pakistan or Greece. I'm sure that in Android 645664 we will finally have the option to give access only to some parts (for example some folders) of the system. But, i think, by then the system will be so complex, that any character entered will result in an exploit.