Nearly 1 million Windows devices were targeted in recent months by a sophisticated "malvertising" campaign that surreptitiously stole login credentials, cryptocurrency, and other sensitive information from infected machines, Microsoft said.
The campaign began in December, when the attackers, who remain unknown, seeded websites with links that downloaded ads from malicious servers. The links led targeted machines through several intermediary sites until finally arriving at repositories on Microsoft-owned GitHub, which hosted a raft of malicious files.
Ad blockers aren't just convenient, they're necessary for online safety. Install it on your family member's devices
If I'm reading this right this still required a manual clickthrough (seemingly forced through a fake video player) and running an executable, right? The description is simultaneously very detailed and fuzzy on the social engineering portion.
Not to say you don't want an adblocker for security reasons, but still, the implication in the reporting is "have an ad pop up, get infected", when it was more "click on the "watch PopularseriesS02e04" prompt, fail multiple times due to it being an obvious scam, get prompted to download some files, install said files, get infected".
It sounded terrifying at first with it sounding like the infection happened without user involvement, but seeing how it still requires user participation makes it seem less alarming.