You can catch a Trojan even if you visit only legitimate websites. This post explains how it happens and what you should do to protect yourself.

Source: https://blog.kaspersky.com/advertising-svpeng/13423/