A drive-by download is the unintended download of malware onto a device simply by visiting a website, opening a malicious ad or viewing a crafted page, often without any click or warning.
How drive-by downloads work
There are two main forms:
- Exploit-based – code on the page probes the browser and its plugins and uses an exploit to run code on the device. No user interaction is needed beyond loading the page. Exploit kits automated this approach on a large scale.
- Deceptive downloads – the page tricks the user into downloading a file, for example a fake browser update, a missing video codec or a “required” font. The SocGholish (FakeUpdates) campaign has used fake browser update pop-ups on compromised websites for years.
Victims reach such pages through compromised legitimate sites, malvertising, SEO poisoning or targeted watering hole attacks. Redirect chains filter visitors by country, browser and IP address, which makes the attacks hard to reproduce. MITRE ATT&CK lists the technique as Drive-by Compromise (T1189).
Why drive-by downloads matter
Drive-by downloads infect users who did nothing obviously risky, such as opening an attachment. In the 2010s they spread ransomware and banking trojans through vulnerable Flash, Java and Internet Explorer installations. Modern browsers with sandboxing and automatic updates have made exploit-based drive-bys rarer and more expensive, so criminals now rely more on social engineering, while state-backed groups still use browser zero-days in targeted attacks.
How to protect against drive-by downloads
- Keep the browser and operating system updated and remove outdated plugins.
- Remember that browsers update themselves; never install an “update” offered by a website.
- Use ad blocking, DNS filtering and web protection from security software.
- Restrict execution of downloaded files and scripts on corporate devices.
