This seems to be affecting users who use the desktop version of Spotify. According to these users, it seems that the ads are launching malicious websites in the browsers of users. These websites contain other malicious ads, phishing scams, and they seem to be able to open the websites without any action from the user, which is admittedly rather worrying.
Spotify has since responded and claim that they are investigating the matter. In the meantime it is unclear as to what users can do to prevent this from happening, but we guess until then users will just need to ensure that when these websites are opened, they don’t click or interact with the website lest malware gets installed.
As pointed out by Business Insider, this isn’t the first time that Spotify’s ads have been hijacked to serve malware, but hopefully this is something that Spotify can fix and prevent it from happening again, because twice in a row doesn’t really inspire a lot of confidence.