Just about 90% of websites use either Facebook or Google pixels. The pixel is a thing which is generally not blocked by browsers or email clients. A hacker may be exploiting that generality by distributing images that are also ‘pixels’ so these go under the nose of content blockers and filters unless pixels are blocked.
See: blog.hootsuite.com/facebook-pixel/
If you’re using an iPhone or a MacBook I’ve helped make your device more secure many times over. I used to hunt bugs for Apple but they (and others) never payed so I stopped doing cyber security freelance through bug bounty programs.