Drive-by Compromise

An adversary gains initial access when a user visits a compromised or adversary-controlled website serving adversary-controlled content, such as injected scripts or malicious advertisements. A common variant delivers exploit code to a vulnerable browser or plugin; depending on the delivery path, user action may be required. Successful exploitation can execute code on the client. This record covers the web-to-client access path; payload staging or command-and-control are separate follow-on actions.