CyberGlossary

Attacks & Threats

Drive-by Download

Also known as: Drive-by attack

Definition

An attack in which malware is silently installed on a victim's device simply by visiting a compromised or malicious website.

A drive-by download exploits vulnerabilities in browsers, plugins, or document readers so that merely loading a web page or advert is enough to deliver malware. The attacker typically hosts an exploit kit that fingerprints the visitor, picks an appropriate vulnerability and runs shellcode that downloads and executes a payload such as a banking trojan, ransomware loader, or backdoor. Compromised legitimate sites and malvertising are common delivery channels. Defences include keeping browsers, OS, and plugins fully patched, removing legacy plugins like Flash, EDR, sandboxed browsing, web-content filtering, application allowlisting, and disabling automatic execution of downloaded files.

Examples

  • A user visits a compromised news site whose exploit kit installs ransomware without any click.
  • Malicious advertising redirects the browser to an exploit landing page that drops an info-stealer.

Related terms