Many people still believe you only get malware from 'bad sites' (or Facebook). But hackers learned long ago that compromising legitimate websites to spread malware gave them a MUCH bigger group of victims to target. Simply put – NO website you visit can be assumed 'safe'. They get compromised all the time. Always stay vigilant.