Most malware comes from something you, the user, has installed. It’s sneaky, in that you probably didn’t mean to install it, but you did it. It’s called “Potentially Unwanted Programs” and this article from MalwareBytes, one of the most trusted anti-malware companies, provides a clear picture of the entire process.