Yeah, it's definitely malicious. When I remove them new ones are added, usually basically the same. They always lead to really bizarre websites which I assume are decoys or something...