The "steganography" is simply to get around ad company filters, and the end result is the classic "You need to install Flash" nonsense soliciting the user to install a DMG.

Well the impact is to persuade you to download and run a file. I think most people on HN will be savy enough not to do that... even if it does claim to be a Flash update.

As others have noted this issue is more about the lax security of ad networks (and their sub networks). Rather than introducing real security, most major ad networks play a cat and mouse game with malware.

Especially if it claims to be a Flash update! What's the intersection of StillUsesFlash & ReadsHN? It's gotta be the empty set at this point, right?

Which, come to think of it, is a great way to screen malware---anyone who will run a flash update probably thinks they need it to get their AOL e-mail, and will happily take the forthcoming call from Apple's Tech Support (TM) asking them for their password and SSN.

if you're not using an Ad blocked, start now. or quit pretending you care about safety. sadly there's no middle ground.

Slightly tangential, but people like to get on a moral high-ground and posture about content creator revenue, but do I really have to care about people not making a revenue from distributing malware and selling my browsing behaviour that's being tracked across the web?

We really need to stop pretending that ad networks are these neutral entities. They are a backdoor that inserted on every website, and I shouldn't have to justify plugging it up, you should have to explain why you've sold my security.

Not to mention the extreme negative psychological and societal consequences of these ad companies. There's no way ad companies are anything but an extreme negative even if they fix their security and only deliver inert payloads. Ad companies were a sickness for society and individuals in the days of TV and newspapers and they are a sickness now. Starving them out of business could be seen as a moral duty to oneself and a benefit to society. If content creators choose to partner with such ad companies, they should accept their fate, that of the ad companies. Or they can figure out a better business model. It's not up to the rest of society to sacrifice itself and the well-being of the people in the rest of society so some ad men can make billions or for some content creators to put out a bunch of content that's almost certainly just garbage. We in the rest of society, owe these ad men and anyone who aligns with them nothing. They're lucky that as a society we allow their sick, disgusting manipulation of others to continue ... for now.

Do there exist any ad networks that only accept an image from the advertiser and provide any analytics themselves (so you only have to trust the ad network and not the advertiser?)

Does Brave block it?

Does anyone have an answer to this question?

The user still needs to go through with the fake Flash update. Even if one is to accidentally fat finger the download, they still have to proceed with the installation. To protect yourself, please be vigilant and only accept software updates directly from the vendor of the software you are using. This is more of a phishing attack to get folks to install malware / adware.