Malware
Malware authors target bugs, or loopholes, to exploit. A common method is exploitation of a buffer overrun vulnerability, where software designed to store data in a specified region of memory does not prevent more data than the buffer can accommodate being supplied. Malware may provide data that overflows the buffer, with malicious executable code or data after the end; when this payload is accessed it does what the attacker, not the legitimate software, determines.
MindGeek
It was reported in April 2013 that visitors to some of the world's most popular (by Alexa rank) pornography sites risked malware being installed on their machines by malicious third party advertisements. The claims were made by security researcher Conrad Longmore, who writes a blog on malware, spam and scams. Longmore's figures were collected using Google Safe Browsing Diagnostics, which looks for harmful content on websites, and the statistics for two sites; xHamster and Pornhub were published by BBC News. The BBC article stated that based on Longmore's research, 5% of pages on xHamster (which has never been owned by Mindgeek / Manwin), and 12.7% of pages on Pornhub incorporated malvertising. MindGeek (still known as Manwin at the time) said in a statement that their own figures showed that 0.003% of the advertisements they served over the period that Longmore's data was collected contained malware, and they said that the advertisements they serve are monitored for malware and malware is immediately removed.