What Is a Drive-by Download?

What Is a Drive-by Download?

A drive-by download is a security incident in which malware is downloaded and installed on a device when a visitor reaches a compromised or malicious website, without their knowledge (opens in new tab). Unlike phishing-delivered malware, which depends on the user opening an attachment or clicking a link, the classic drive-by variant needs nothing beyond the page visit itself. Exploit code targets a vulnerability in the browser or a plugin as the page renders.

How a drive-by download works

The attack starts with placement. An attacker injects exploit code or malicious JavaScript into a legitimate website they have compromised, or serves it through a malicious ad on a trusted ad network. Drive-by Compromise (T1189) (opens in new tab) sits under the Initial Access tactic in MITRE ATT&CK. From the initial page, a redirect chain routes the visitor's browser through intermediate pages that filter by geolocation and device type. That filtering also hides malicious content from web crawlers and security-vendor sandboxes, so only real visitors reach the payload.

The final hop is a hidden landing page that fingerprints the browser (opens in new tab) and its plugins for vulnerable versions. If it finds one, the exploit fires, executes shellcode, and loads the malware. If the device is fully patched, the exploit kit stops the chain. The visitor often sees no visible sign.

SocGholish, also called FakeUpdates, shows the modern deception-based version of the chain. Injected JavaScript on a compromised legitimate site checks the visitor's browser and displays a matching fake update prompt, and the visitor downloads a zip file containing a malicious script. Because the technique substitutes deception for exploitation during initial code delivery, it uses no software exploits (opens in new tab). SocGholish topped MS-ISAC's malware detections (opens in new tab) in Q2 2025.

Why drive-by downloads are hard to stop

Browser hardening pushed attackers toward deception, and deception evades the controls built for exploits. Fake browser update lures (SocGholish, ClearFake) and fake CAPTCHA pages that tell users to paste commands into a terminal (ClickFix) sidestep the exploits, attachments, and malicious links that scanners flag. ClickFix-style delivery (opens in new tab) places the malware download directly on the endpoint, bypassing browser-based controls. ClickFix was the most common initial access technique Microsoft's Defender Experts observed between July 2024 and June 2025, at 47% (opens in new tab) of cases.

Bypassing those controls buys attackers a foothold that is rarely the end goal. Drive-by campaigns commonly deliver loaders and infostealers, and initial access brokers resell the access they establish. Interlock ransomware operators gained initial access (opens in new tab) via drive-by download from compromised legitimate websites, disguising payloads as fake Google Chrome or Microsoft Edge browser updates.

Deception-based lures also ride on impersonation. Attackers build typosquatted and combosquatted copies of legitimate software sites, then pay to promote them in search results. That puts the delivery infrastructure for drive-by downloads squarely inside the brand-protection perimeter.

Types of drive-by download attacks

Drive-by download attacks have two core variants plus several delivery patterns built on them:

• Unauthorized (silent) drive-by: Visiting the page is enough. Exploit code runs against a browser or plugin vulnerability with no user interaction. This was the model of the exploit-kit era, when kits like Angler, RIG, and Magnitude targeted Flash, Java, and Internet Explorer.
• Authorized (deceptive consent) drive-by: The user takes an action, clicking a deceptive link or downloading a fake update, without understanding what the installer actually loads. SocGholish and ClearFake operate here.
• Watering hole attack: A targeting strategy in which attackers compromise a site a specific community visits, then use drive-by delivery against those visitors. In August 2025, Amazon disrupted an APT29 watering hole (opens in new tab) campaign that redirected visitors of compromised sites to fake Cloudflare verification pages.
• Malvertising-delivered drive-by: Attackers purchase malicious ads through legitimate ad providers to route visitors to exploit or lure pages. One large-scale malvertising campaign (opens in new tab) ran from illegal streaming sites through redirectors, with attackers hosting the infostealers on GitHub.
• SEO-poisoned fake installers: Poisoned search results rank lookalike download pages above legitimate ones. Storm-2561, for example, uses SEO poisoning to distribute fake VPN clients (opens in new tab) that harvest corporate credentials.

How to defend against drive-by downloads

Defense against drive-by downloads is layered, and the layers map to MITRE ATT&CK mitigations for T1189:

• Patch browsers and plugins. Keeping browsers and plugins updated can prevent the exploit phase. Prioritize with CISA's Known Exploited Vulnerabilities (opens in new tab) catalog.
• Deploy exploit protection. Exploit-behavior protection such as Windows Defender Exploit Guard blocks exploitation behavior (opens in new tab), and an intrusion prevention system virtually patches known vulnerabilities in outdated applications.
• Isolate the browser. Browser sandboxes (opens in new tab) and application microsegmentation contain the impact of client-side exploitation.
• Restrict web content. Ad blockers help prevent malicious ads from executing code, and script blocking (opens in new tab) stops JavaScript-based delivery when teams enforce it correctly.
• Filter DNS. DNS filtering services (opens in new tab) on all end-user devices block access to known malicious domains.
• Watch endpoint behavior. Browser processes that spawn unusual children are one sign of a drive-by in progress, along with unsigned modules or files written shortly after requests (opens in new tab) to previously unseen domains.
• Monitor the external staging layer. Attackers build lookalike domains, malicious search ads, and spoofed download pages before any employee or customer visits them, and finding that infrastructure early enables takedown before the campaign converts.

How Doppel helps

Doppel is the AI-native Social Engineering Defense (SED) platform that unifies Digital Risk Protection and Human Risk Management. Drive-by campaigns depend on impersonation infrastructure: typosquatted domains, scam ads, fake update pages, and spoofed installers that stage the delivery. Doppel's agentic AI continuously scans domains, social platforms, paid ads, app stores, and dark web channels to find that infrastructure in real time. The Doppel Threat Graph then correlates the spoofed domains, malicious ads, and fake landing pages into a single campaign view, linking them by shared hosting, phone numbers, and registrar records.

The same agentic AI executes coordinated, campaign-level takedowns via platform APIs across registrars, hosts, and ad networks, with analysts overseeing the cases it escalates. Because those takedowns reach the live lure page and the backup infrastructure staged alongside it, they compress the exposure window before a campaign can convert visitors or reuse its fallback.

A demo walks through how the platform maps and dismantles the infrastructure staging drive-by delivery against your brand. Request a demo to get started.

Frequently asked questions about drive-by downloads

What is a drive-by download?

A drive-by download is the installation of malware on a device when a visitor reaches an infected or malicious website, without the visitor knowingly initiating the download. It comes in two variants: an unauthorized variant, where exploit code silently attacks a browser or plugin vulnerability the moment the page loads, and an authorized variant, where attackers deceive the visitor into downloading something, such as a fake browser update, without understanding what it contains. Both variants can end with attacker-controlled code running on the victim's device.

What is a drive-by download in cybersecurity?

In security operations, drive-by compromise is an initial access technique under MITRE ATT&CK T1189 in which adversaries gain access through compromised websites and web applications visited during normal browsing. Advertisements can carry the same access, and merely loading a page that hosts exploit code can be enough. A hidden landing page checks the browser and plugins for vulnerable versions and fires an exploit if it finds one, often with no visible sign for the visitor. Modern browser hardening has made that harder, which is why many attackers now use deception-based lures instead, though silent exploitation continues through zero-day vulnerabilities and against mobile targets.

What is the difference between a drive-by download and a watering hole attack?

A watering hole attack is a targeting strategy, while a drive-by download is a delivery mechanism frequently used within one. In a watering hole attack, the adversary deliberately compromises a website that a specific community visits to expose those visitors to infection. The intended visitors might belong to a government agency, an industry group, or a particular region. The compromised site typically delivers the infection as a drive-by download. Watering hole campaigns frequently use drive-by delivery, but not every drive-by download is a watering hole attack.

What is an example of a drive-by download attack?

SocGholish, also called FakeUpdates, is a current example. It injects malicious JavaScript into compromised legitimate websites and shows visitors a fake update prompt that matches their browser. Downloading the "update" installs a script that opens the door to remote access trojans and, in documented cases, ransomware. Interlock ransomware operators worked the same way. They gained their foothold through drive-by downloads on compromised legitimate sites and disguised payloads as Google Chrome or Microsoft Edge updates.