Thanks Treches - that was pretty helpful. I understand that means there is an additional step after clicking the bad link. My browser blocked the ****** but because these links are on our own sites, I suspect many will not have pop ups etc blocked.
Regarding the hacker... the ****** link insert is being done by a script based on the time of the file updates and the specific target files, but it does not seem likely that a script is look for encrypted OOTP online league files. That seems like a manual job by someone who is at least aware of this game (enough to know it has an online league mode to it).