Generally speaking the best I can do is report to our ad partner. Of course if it’s widespread enough I can turn off ads until it’s resolved, but not always easy to jump in and make that change timely.
I’m 95% sure these usually come from backfilling programmatic ads, which virtually all networks do these days, but FWIW we’ve been able to increase the number of direct placements which are very unlikely to contain anything malicious.
TL;DR; will report this and I appreciate you making me aware. If it’s resolved for you, likely it was caught and removed already.