having hacked websites serve infected or specially crafted files that exploit 0 day bugs is a very common vector actually. like 0 day PDF reader bugs - they spr

having hacked websites serve infected or specially crafted files that exploit 0 day bugs is a very common vector actually. like 0 day PDF reader bugs - they spread by being linked to in phishing emails for example. people click on them and boom they load a bad PDF and are drive by infected. specially crafted jpgs and gifs have also been used to exploit overflows in image handling code.