Drive-by Download / Watering Hole Attack

Adversaries gain initial access when a user visits a website or other web content that delivers exploit code to browser or client software. Delivery may use a compromised legitimate site, modified scripts served to a legitimate site, malicious advertising, or injected user-controllable content such as scripts or iframes. If the client is vulnerable and protections do not stop exploitation, the attacker may gain code execution on the endpoint. Some variants require the user to enable active content or dismiss a prompt; a page visit alone is not always sufficient.