# What is a Drive-By Compromise?

> A drive-by compromise is unauthorized access gained through a victim’s visit to a website — by exploiting the browser or its components, or by deceiving the visitor into downloading or running content — without requiring the victim to knowingly install software.

- Canonical URL: https://yellowcube.eu/glossary/drive-by-compromise/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The destination may be a site the attacker controls, a compromised legitimate site, or content injected through advertising or third-party resources. Delivery can be indiscriminate or restricted to selected visitors by geography, device, or other profile characteristics.

Classic cases exploit unpatched browsers, plug-ins, or rendering components during page load. Other flows rely on deception — a fake update, a disguised installer prompt, or a permission request that leads the visitor to run something voluntarily. The distinguishing feature is that browsing itself is the attack path.

### Key points

- **Delivery paths:** Exploit of browser or component weaknesses, malicious or hijacked page content, compromised third-party resources, deceptive downloads, and permission or notification prompts.
- **Investigation:** Preserve the page address, time, redirect chain, browser and extension versions, downloaded artifacts, and endpoint and network telemetry without revisiting the content.
- **Risk reduction:** Maintain browsers and related components, govern extensions, apply web filtering and isolation where justified, monitor for post-visit execution, and give users a way to report suspicious pages.
- **Important limitation:** A page visit preceding an infection does not prove the page caused it, and content that targeted only some visitors may be unrecoverable afterward. Blocking a single domain rarely ends a campaign that can rotate infrastructure.

### Related terms

[Watering hole attack](<https://yellowcube.eu/glossary/watering-hole-attack/>) · [Malvertising](<https://yellowcube.eu/glossary/malvertising/>) · [Exploit](<https://yellowcube.eu/glossary/exploit/>) · [Browser security](<https://yellowcube.eu/glossary/browser-security/>) · [Malware](<https://yellowcube.eu/glossary/malware/>)

### Sources

[MITRE ATT&CK T1189: Drive-by Compromise](https://attack.mitre.org/techniques/T1189/) · [CISA: Securing Web Browsers and Defending Against Malvertising](https://www.cisa.gov/sites/default/files/2023-09/Non-Fed%20-%20Guidance_for_Securing_Your_Web_Browsers%20Aug-23%20Revision.pdf) · [NIST SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling](https://csrc.nist.gov/pubs/sp/800/83/r1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.