That’s the unsettling story that comes out of the Times’s explanation of the incident, in which an untold number of the sites’ visitors were served up with an ad promoting malware.

The attack, which the Times says was also directed at other, unnamed news organizations, is worrisome enough. But the fact that the culprits behind it essentially walked right into the front door of the New York Times (NYT) and conned the paper into distributing the fraudulent ads is really scary.

The short version: The Times says that someone who “masqueraded as a national advertiser” bought ad space on the site, which is visited by some 45 million people a month from the U.S. alone. The unnamed buyer “provided seemingly legitimate product advertising for a week.”

UPDATE: The Times says the fake ads were for Internet phone service Vonage.

Then, over the weekend, the culprits started churning out the malware. The Times has issued a statement explaining some of what happened, which I’m reprinting at the bottom of this post (the paper also has a consumer guide to help you protect yourself from malware, viruses and other Web unpleasantness).

But the statement is a bit confusing and seems to indicate that the paper was compromised by an ad network it used to sell remnant space on the site. That’s what I thought might have happened at first, and that’s what the paper’s tech staff thought as well–note the reference to “suspending all third-party advertisements on the site.”

But I double-checked with Times spokeswoman Diane McNulty, who confirmed that that paper’s own staff had sold the fake ad.

How could this happen? I don’t know–anyone with Web buying experience want to weigh in? But I do know that it’s not the first time bogus ad buyers have bought space directly from publishers.

Earlier this year, I wrote about an incident in which someone pretended to buy ads on behalf of Hyundai. And that story elicited a response from an ad exec at a very big, very well-known Web publisher, who told me that in 2008, his employer had received a large order on behalf of a different auto company, and ran some of the ads before figuring out they were fakes.

Here’s the Times’s explanation:

As you know, over the weekend, nytimes.com was the victim of a malware attack that targeted several news organizations. The culprit masqueraded as a national advertiser and provided seemingly legitimate product advertising for a week. Over the weekend, the ad being served up was switched so that an intrusive message, claiming to be a virus warning from the reader’s computer, appeared.

As soon as we were made aware of the situation, we took aggressive steps, suspending all third-party advertisements on the site. We posted information about the attack on our home page and directed readers on what to do if they encountered the malicious code. There is additional information posted today on our homepage and our Gadgetwise personal technology blog.

We now know how it occurred and have taken steps to prevent a similar situation from happening.

Now Razorfish is formally on the block: The Financial Times reports that Microsoft (MSFT) has hired Morgan Stanley to hawk the agency and suggests that French ad conglomerate Publicis Groupe could be a buyer. Then again, so could every other big ad holding company, including Omnicom (OMC) and WPP (WPPGY).

The FT throws out a value of $600-$700 million for Razorfish, down from the $800 million price tag that AdAge put on the shop last summer, which was the last time sales chatter heated up. At the time, the buyer was supposed to be WPP. Microsoft paid $6 billion for all of aQuantive in 2007.

Why has everyone been so convinced that Microsoft would sell something it bought in 2007? Because everyone thought that Microsoft never wanted Razorfish–it wanted the rest of aQuantive’s ad network business. And presumably what it really wanted was Doubleclick’s ad network business, but Google (GOOG) beat it out on that deal. Yahoo (YHOO) had already bought RightMedia and WPP bought 24/7 Real Media. (Boy, a lot of money was spent on ad networks back then! And not coincidentally, a flood of ad network start-ups flooded the market shortly after those transactions went through.)

Meanwhile, Microsoft’s own people have never tried particularly hard to argue that the company was committed to owning an ad agency. Though they did try to argue that owning one wasn’t a conflict with the online publishing business it keeps burning money on. Now that won’t be a problem.

[Image credit: g-hat]

If you’re not paying attention, it may seem as if the cratering economy hasn’t stopped the steady stream of start-up funding announcements.

Today, for instance, we learned that online music distributor TuneCore has raised $7 million, while CrispyGamer, a newish videogame site, has raised $8.25 million from J.P. Morgan’s Constellation Ventures.

But don’t be deceived: Almost all of the deals you’ve read about recently, as well as the ones you’ll see for the next few weeks, were closed earlier this fall.

If you want to get a sense of why these announcements will slow to a trickle going forward, scan down through VentureBeat’s discussion of CrispyGamer’s business.

Let’s leave aside the basics. The site wants to make a name for itself in the crowded world of videogame review sites by offering high quality reviews, but it’s not clear that CrispyGamer’s reviews are much different than its peers, and it’s not clear that readers are making the distinction either.

Instead, focus on the dollars, from the VentureBeat report:

Right now, the site isn’t commanding huge ad rates. It gets about a $2 CPM (cost per million, a measure of the amount of money that comes in for every 1,000 readers). Just a month ago, it looked like it would get $8 CPMs, but the economic downturn is taking a toll. CrispyGamer relies on a half-dozen ad networks to feed it the ads.”

Assume that the CripsyGamer folks, like most publishers, are inflating their advertising rates (and traffic, too) for public consumption. It’s still telling VentureBeat that its ads have been marked down 75 percent in the last month.

Yikes.

The upside, I suppose, is that CrispyGamer has advertising revenue, period. There are plenty of ad-supported start-ups that have yet to get around to actually selling ads, and it’s going to be awfully difficult to start doing so now.

And, if you want to be really generous, you could argue that videogames are going to get beaten up less badly than other sectors during the coming recession/depression/meltdown/whatever. In theory, dudes will keep buying videogames, while they hunker down in their basements, because it’s cheaper than most other entertainment options.

But CrispyGamer also says it has a staff of 20 people, including five full-time writers (what does everyone else do there?). That’s an awfully big staff to keep afloat on $2 CPMs–and it’s hard to imagine that CripsyGamers’s backers imagined that’s what they were getting into earlier this year.

[Image Credit: Itjournalist]