Browser-delivered malware rides on search ads, fake update prompts, and spoofed pages. The user starts every step, which is exactly why perimeter tools miss it.