DrivebyDownloads

Drive-by downloads are malware infections that occur when a user visits a compromised or malicious website, triggering an automatic download or installation of malicious software without the user’s explicit consent. They often exploit vulnerabilities in the browser or its plugins, meaning the user may not need to interact beyond visiting the page.

In practice, drive-by downloads use exploit kits or drive-by-download techniques delivered via compromised sites or malvertising. Exploit kits scan for known vulnerabilities and deliver payloads, such as ransomware, trojans, spyware, cryptocurrency miners, or adware. Some implementations rely on rendered code or script to initiate the download behind the scenes, using iframes or redirects. Modern browsers and protections have reduced risk, but vulnerabilities and misconfigurations remain.

Common vectors include compromised legitimate websites, malicious advertisements (malvertising), and outdated or insecure browser plugins. As plugins decline in use, attackers increasingly target browser flaws and misconfigurations, with some infections occurring with little or no user interaction beyond visiting a page.

Defense and mitigation include keeping software up to date with security patches, disabling or removing unnecessary plugins, and enabling safer browsing modes or sandboxing. Use reputable security software with real-time protection, enable browser security features, and consider ad-blockers or network-level DNS filtering to reduce exposure to malvertising. Practicing safe browsing, avoiding suspicious sites, and applying organizational web-filtering policies can further limit risk.