For these users, downloading a video was a deliberate process:
Aggressive advertising networks on unverified sites frequently deploy pop-ups or forced downloads containing malicious software.
: Many legacy domains are now owned by cyber-squatters. Visiting them often triggers aggressive redirects, pop-up ads, or automatic downloads of malicious .apk files designed to infect mobile devices.