You can use Javascript in an ad to make the browser connect to the internal IP address, which often is something like 192.168.1.1 and then once you’re in you can add the device to a botnet and sell its bandwidth or reroute its traffic.