You don't literally have to have every website on board. You just need a critical mass such that any given malware-infected user will encounter a website that they consider important but that they can't access, and therefore have an incentive to take steps to remove the malware. That goes a long way to deprive the malware authors of infected users, even if there continue to be some websites that don't block the malware.

And as for browser and OS vendors, it seems like there is a clear way for the Times to push that along: If this problem is nontrivially impacting ad revenue then Google has a clear incentive to work with them on Chrome and Android, and with that as leverage, they can go to other browser and OS vendors and say "take the same measures to keep your users from coming to our website infected with this crap or we'll be recommending that they use Google's products instead."