The findings made their way public in this Google security blog, which notes the dilemma of online advertising -- Google's cash cow -- serving up maliceware alongside marketing materials to a public that all too often can't tell thye difference.
Google's technical report on the problem is here.