Home / Knowledge hub / Drive-by download
Knowledge hub
Drive-by download
Software installed just by visiting a page, without any click or consent.
What it means
A drive-by download is an infection that happens when someone merely visits a web page. The page, or a script or advertisement on it, exploits a flaw in the browser or a plug-in and installs software without the person agreeing to anything. MITRE ATT&CK lists the technique as drive-by compromise.
It differs from a trick download, where a person is persuaded to run a file. Here the visit itself is enough, as long as the visitor's software has a weakness the attacker can use.
Why it matters
Your site can carry it without being the target. An attacker who gets a malicious script onto your pages, through a compromised third-party library, an ad network or a hijacked account, turns your visitors into victims and your brand into the delivery route.
The fallout is reputational and practical: browser and search warnings, blocklisting, customer complaints, incident work and, where personal data is involved, possible reporting duties. Prevention is dull and cheap by comparison.
How it shows up
It is less common than it once was, because browsers update quickly and have dropped most plug-ins. It still turns up through out-of-date browsers, compromised websites that inject scripts, malicious adverts and weak third-party tags.
The mistakes repeat. Third-party scripts load without any limits. Libraries are never updated. Admin accounts have no multi-factor sign-in. Check which scripts load on your pages, use subresource integrity and a content security policy, patch your dependencies, and monitor for changes to your pages.
Questions people ask
Drive-by download, answered
Is a drive-by download the same as phishing?
No. Phishing persuades a person to hand over information or open something. A drive-by download needs no decision from the visitor beyond opening the page.
They are sometimes combined, with a phishing email leading to the page.
Can our own website cause one?
Yes, if an attacker can add script to it. Common routes are a compromised third-party script, a hijacked admin account, or an injection flaw. Your visitors then get the payload from your domain.
That is why the page's contents deserve monitoring.
How do we reduce the risk on our site?
Keep third-party scripts to a minimum, add subresource integrity where you can, set a content security policy, update libraries and CMS plug-ins, and protect admin accounts with MFA.
Watch for unexpected changes to your pages.
Do modern browsers prevent these?
They make them harder. Automatic updates, sandboxing and the removal of most plug-ins have closed many routes. Targeted attacks still use fresh flaws before patches arrive.
Keep browsers updated on company devices.
How do we know if our site is serving malware?
Check browser and search warnings, scan the pages with a reputable service, compare delivered scripts with what you expect, and review recent changes to templates and tags.
If you find something, treat it as an incident.
Sources
Where this comes from
Related
Terms that sit next to this one
Third-party script risk
Code from outside vendors running on your pages with the same powers as yours.
Subresource integrity
A hash check that stops a tampered third-party script or stylesheet from loading.
Malware
Software built to damage systems, steal data or give an attacker control.
Content Security Policy
A header telling the browser which scripts a page may load.
Supply chain attack
Reaching you through a library, a build tool or a vendor you trust.
What runs on your pages?
We find vulnerabilities that let outside code reach your pages, such as injection points, and prove each by exploiting it. Findings carry the request and response. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.