Either by linking to malware so you get infected if you click the ad, or by containing malware directly. Ads can contain code, making them almost like small applications that run when loaded.