In most Web attacks, malware is downloaded to victims' machines from a malicious or a compromised server. However, a researcher has uncovered a new attack vector where the malicious file is downloaded without actually being uploaded anywhere. Another info also here.