Stevens created an advertisement on Google AdWords offering users the chance to infect their PC with malware simply by clicking on a link.
The ad stated: 'Is your PC virus-free? Get it infected here!'. The ad was displayed 259,723 times and 409 people clicked on the link.
The site contains no malware, but security experts warned that similar methods are used by hackers to get users to visit sites containing viruses and malware that infect the user's machine.
Stevens ran the ad for six months for around $23, which means that it cost only six cents per click or per potentially compromised machine.
"I designed my ad to make it suspect, but even then it was accepted by Google without problem and I got no complaints to date, and many users clicked on it," Stevens wrote on his blog.
"Now you may think that they were all stupid Windows users, but there is no way to know what motivated them to click on my ad. I did not submit them to an IQ test."
Lenny Zeltser, a security consultant at Gemini Systems, said: "Perhaps there is no need for attackers to create advanced redirection chains or elaborate deception schemes. As Stevens's experiment confirmed, people will click on anything."
Google has since disapproved and removed the ad, stating that it violates AdWords editorial guidelines.
Cotton seedling freezes to death as Chang'e-4 shuts down for the Moon's 14-day lunar night
Fortnite easily out-earns PUBG, Assassin's Creed Odyssey and Red Dead Redemption 2 in 2018
Meteor showers as a service will be visible for about 100 kilometres in all directions
Saturn's rings only formed in the past 100 million years, suggests analysis of Cassini space probe data
New findings contradict conventional belief that Saturn's rings were formed along with the planet about 4.5 billion years ago