An exploit kit is a toolset that tries to find a weakness in a visitor's browser or plugins and then delivers exploit code to use it. MITRE describes this process in its entry on drive-by compromise. If the exploit works, the attacker can gain code execution on the visitor's system.
- Also Called2other namesexploit pack · EK
- Related Terms3linked entriesMalvertising · Zero-day vulnerability · Proof-of-concept exploit
What Is an Exploit Kit?
An exploit kit is a collection of tools that tries to find a weakness in a visitor’s browser or plugins and then delivers exploit code to use it. MITRE ATT&CK covers this under drive-by compromise, which it describes as adversaries gaining access to a system through a user visiting a website over the normal course of browsing. MITRE also notes that a threat group, Dragonfly, has used a custom exploit kit.
What Happens When Someone Visits a Kit Page?
MITRE describes the usual steps of a drive-by compromise:
- A user visits a website that hosts content controlled by the adversary.
- Scripts run automatically and typically check the versions of the browser and plugins for a potentially vulnerable one.
- If a vulnerable version is found, exploit code is delivered to the browser.
- If the exploit succeeds, the adversary gains code execution on the user’s system, unless other protections are in place.
MITRE says the user may sometimes need to help, for example by enabling scripting or ignoring warning dialogs, and that a second visit is sometimes required before exploit delivery happens.
How Do Victims Reach an Exploit Kit?
MITRE lists several delivery routes for drive-by compromise, including compromised legitimate websites, modified script files from cloud storage, malicious ads served through ad providers, and web application vulnerabilities. It gives one example of use by a named group: Dragonfly has compromised targets through strategic web compromise using a custom exploit kit.
Which ATT&CK Techniques Cover an Exploit Kit Attack?
MITRE splits the chain into preparation, delivery and execution. Four techniques fit an exploit kit.
| ID | Technique | What MITRE says |
|---|---|---|
| T1583.008 | Acquire Infrastructure: Malvertising | Adversaries buy online ads that can be abused to distribute malware. Ads may spoof well-known brands. |
| T1608.004 | Stage Capabilities: Drive-by Target | Adversaries prepare an environment to infect systems that visit a site. Drive-by content is staged on infrastructure they own or have compromised. |
| T1189 | Drive-by Compromise | A user visits a site the adversary controls. Scripts check the browser and plugins and deliver exploit code to a vulnerable one. |
| T1203 | Exploitation for Client Execution | Adversaries exploit flaws in client applications such as browsers to run code. |
Why Are Old Browsers and Plugins the Weak Point?
The compromise starts when a user visits a site during normal browsing. Success depends on whether the browser or plugin is a vulnerable version, so out-of-date software is the weak point. The result of a successful exploit, code execution, can give an attacker a base for further steps.
Which MITRE Mitigations Blunt an Exploit Kit?
MITRE lists these mitigations for drive-by compromise.
- Keep all browsers and plugins updated, which can help prevent the exploit phase.
- Use ad blockers and script-blocking extensions, which can help stop malicious code from running.
- Use browser sandboxes to limit the impact, although MITRE notes sandbox escapes may still exist.
- Use exploit protection tools that counter exploitation behavior.
- Disable browser push notifications from untrusted sources and train users about social engineering.
Is an Exploit Kit the Same as an Exploit?
No. An exploit is code that takes advantage of one bug or vulnerability. An exploit kit is a package that looks for a suitable weakness in a visitor’s system and delivers an exploit for it.
Is an Exploit Kit the Same as Malware?
Not exactly. The kit’s job is to get code running on a system. What runs after that is a separate matter. Related terms include proof-of-concept exploit, zero-day vulnerability and malvertising.
Related Pages in the Knowledge Hub
Also Called.
- Nameexploit pack
- NameEK
Questions.
-
What is an exploit kit?
An exploit kit is a toolset that tries to find a weakness in a visitor's browser or plugins and then delivers exploit code to use it. MITRE covers this under drive-by compromise.
-
How does an exploit kit work?
A user visits a website with content the attacker controls. Scripts check browser and plugin versions, and if a vulnerable one is found, exploit code is delivered. If it succeeds, the attacker gains code execution on the user's system.
-
Where does exploit kit content come from?
MITRE lists several routes: compromised legitimate websites, modified script files from cloud storage, malicious ads served through ad providers, and web application vulnerabilities. One example it gives is attackers placing content on sites that visitors trust.
-
How can I reduce the risk from exploit kits?
Keep all browsers and plugins updated, which can help prevent the exploit phase. MITRE also lists ad blockers and script-blocking extensions as mitigations for drive-by compromise.
Sources
In Our Research
- 1 Turn a Threat Report Into ATT&CK Mappings and Sigma Rules With an AI Agent October 2026
- 2 PHP2Shell: Two Critical PHP Flaws Reported as RCE, CVE-2026-109618 and CVE-2026-109619 October 2026
- 3 APT3 (BORON): A Pioneering China-Aligned Cyber Espionage Group January 2026
- 4 Forum Watch: What Cybercriminals Are Selling | Dark Web Insights November 2025
- 5 Cybersecurity: Emerging Threats and Lessons Learned from the Past Year December 2024
- 6 BellaCiao: The New Malware From Iran’s Charming Kitten May 2023