Ad networks have been used to distribute malware for years. When you're an ad sales guy and get a call from a new, big-spending client with no performance goal

Ad networks have been used to distribute malware for years. When you're an ad sales guy and get a call from a new, big-spending client with no performance goals, it's hard to say no. And attackers even exploit ad servers directly. We had a client whose OpenX credentials were compromised, and the attacker was able to directly modify the (otherwise legit) ad tags in the database. They turned the exploit code on and off in the ad tags of legit clients to avoid detection. We had an outside security technology co scanning the tags who picked that particular hack up pretty quickly, but not everyone does...