Web application vulnerabilities are discovered and used to compromise legitimate websites and force them to serve malware to selected visitors.

FORBES: To Stop Cybercrime: Understand Crime Logic, And Adapt