A couple of years ago, a fairly well known Norwegian news outlet's ad network was hacked, and visitors were served malicious code. If the user had Java installed the code would use a 0-day exploit to _silently and without any user intervention_ install a trojan which would activate when the user later visited the online bank of by far the most common bank here in Norway.
It would then redirect money by modifying the target bank account when the user paid bills or whatnot. The web page looked entirely as it should, it would just modify the request before it got sent.
Now, the user had to have Java installed you might say, so not a big deal. Well, big deal, because the same bank, the most popular one, _required_ Java for signing in to their online bank.
Fortunately the breach was noticed fairly quickly and the harm was limited. But after that I decided no more ads.