: They typically use "pop-under" ads that redirect users to unsafe web pages before a download starts.