Log in Request a demo

Attack technique

Drive-by Compromise

Drive-by Compromise is a way for attackers to gain access to a computer when a person visits a website during normal browsing.

In short

Drive-by Compromise is a way for attackers to gain access to a computer when a person visits a website during normal browsing. The site, or something it loads, delivers malicious code to the browser. MITRE ATT&CK lists it as an Initial Access technique.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Initial Access · Step 3 Of 15 In The Attack Chain

  1. MITRE IDT1189ATT&CK technique
  2. Detection4ways to spot itDetection strategy MITRE lists
  3. Defences4ways to stop itLimit web content · Contain the browser

How it works

The person does not need to open an attachment or click a suspicious link in a message. Visiting a page is enough. MITRE describes several ways the code can reach the browser: a legitimate website is compromised, script files from a writeable cloud storage bucket are changed, malicious ads are served through ad providers, or a site feature that accepts user content is abused to insert scripts. Browser push notifications can also be abused if a user clicks allow.

Attackers often pick a website used by a specific community, such as a government, an industry or a region. MITRE notes that this kind of targeted campaign is often called a strategic web compromise or watering hole attack.

In a typical case, scripts on the page check the browser and its plugins for a vulnerable version. If one is found, exploit code is delivered. If it works, the attacker can run code on the user’s system unless other protections stop it.

MITRE separates this from Exploit Public-Facing Application. Here the target is software on a user’s device, which can give the attacker a route into the internal network.

A real example

MITRE ATT&CK lists these procedure examples:

  • Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the page body or a script file.
  • SocGholish was distributed through compromised websites, with malicious content often posing as browser updates.
  • Grandoreiro used compromised websites and online ads to lure victims into downloading its installer.
  • REvil infected machines through compromised websites and exploit kits.

How to detect

  1. Unusual browser and network activity

    Look for the browser fetching resources from domains not seen before, or script content that looks altered, using proxy, firewall and web logs.

  2. Odd child processes from the browser

    A browser that starts unexpected programs, loads unsigned modules or injects into other processes shortly after a page visit is a warning sign.

  3. File and account changes after a visit

    Watch for new files or registry changes soon after web requests, and for unusual sign-ins, token use or consent events after a suspected endpoint compromise.

  4. Detection strategy MITRE lists

    DET0176, Drive-by Compromise: Behavior-based, Multi-platform Detection Strategy (T1189).

How to defend

  1. Keep browsers and plugins updated

    Updated software closes the holes exploit code relies on. Use modern browsers with their security features turned on.

  2. Limit web content

    Ad blockers and script blocking extensions can stop malicious code served through ads or scripts. Consider disabling browser push notifications from certain applications and browsers.

  3. Contain the browser

    Browser sandboxes, other virtualization and application microsegmentation reduce the impact of an exploit, though escapes can still exist.

  4. Use exploit protection and training

    Security tools that spot exploitation behavior and control flow integrity checks can stop some exploits. Train users to recognize manipulation attempts.

Questions

What is a drive-by compromise?

Drive-by Compromise is a way for attackers to gain access to a computer when a person visits a website during normal browsing. The site, or something it loads, delivers malicious code to the browser.

Do I have to click anything for a drive-by attack to work?

The person does not need to open an attachment or click a suspicious link in a message. Visiting a page is enough, for example a legitimate site that has been compromised or malicious ads served through ad providers.

What is a watering hole attack?

Attackers often pick a website used by a specific community, such as a government, an industry or a region. MITRE notes this kind of targeted campaign is often called a strategic web compromise or watering hole attack.

How do I defend against drive-by compromise?

Keep browsers and plugins updated, use modern browsers with security features on, and consider ad blockers and script blocking. Browser sandboxes and microsegmentation reduce the impact of an exploit, and user training helps.

In our research

  1. Initial access techniques: all 11 in MITRE ATT&CK October 2026
  2. DarkHotel (APT-C-06 / ATK52 / DUBNIUM): The Global Espionage Network Behind Elite Cyber Intrusions March 2026
  3. APT3 (BORON): A Pioneering China-Aligned Cyber Espionage Group January 2026
  4. APT35: Iran’s Persistent Cyber Espionage Force January 2026
  5. APT37: North Korea’s Active Cyberespionage Group November 2025
  6. BellaCiao: The New Malware From Iran’s Charming Kitten May 2023

Sources

  1. MITRE ATT&CK T1189: Drive-by Compromise MITRE
  2. MITRE ATT&CK Tactic: Initial Access MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Read more

Threat group

APT19

MITRE ATT&CK describes APT19 (also Codoso) as a Chinese-based group that has targeted defense, finance, legal and other industries, with activity reported in 2014 and 2017. Only MITRE ATT&CK documents this group, no government advisory names it, and MITRE says it is unclear whether APT19 and Deep Panda are the same group.

Read more