You don't need to compromise a site they visit regularly, there are plenty of other ways to get someone to visit a malicious page, phishing email or even a link on HackerNews for example. People will visit new sites for all kinds of reasons, you'd just need to understand your target.