The Counter.php strain of malware is leveraging its redirect functionality to send victims to websites serving up the Styx exploit kit.