Over three quarters of websites with malicious code were legitimate sites that had been compromised this year.