I don't know how it's done either, and I've heard about them a few times. It seems somewhat unlikely that there is a remote code execution vulnerability being exploited only by adverts that hasn't been urgently fixed by the browsers.

If there genuinely is an exploit, an advert blocker isn't enough as you could put it on any website as well.

Therefore I wonder if it's possible that someone has a mis-informed definition of viruses and really it's something a little different, such as a simple link to actively download malware.

> If there genuinely is an exploit, an advert blocker isn't enough as you could put it on any website as well.

Sure, but then people need to visit that website. Ad networks are a popular delivery method because it gets your code out to millions of people quickly. Putting your exploit on a new Tumblr blog doesn't get you a big botnet.

Does it really matter? I don't see the value gained in spending my CPU power on their dark pattern BS, OR is downloading malware via exploit code.

The threat is there and I'm not interested in taking the risk.

> I don't know how it's done either, and I've heard about them a few times. It seems somewhat unlikely that there is a remote code execution vulnerability being exploited only by adverts that hasn't been urgently fixed by the browsers.

Flash. And there are a lot of unpatched browsers out there. Between the two, there are lots of users vulnerable to malvertising.

An ad blocker doesn't address the whole of the vulnerability space, but it is a significant mitigation.