The bottom line, though, is that ads DO serve malware. I work for an endpoint protection company and the most common traces we get from our customers are ones that originate from ads on legitimate websites.