Drive-by download attacks

Key takeaways

• A drive-by download attack installs malware automatically when you visit a compromised site—no clicks required.
• Even trusted websites can unknowingly deliver malware through compromised ads or injected scripts.
• Prevention requires consistent patching, using secure browsers, blocking risky content, enforcing endpoint security, and user awareness.
• Real-world case: Reputable outlets like The New York Times and BBC once unknowingly spread malware via malicious advertisements.

Drive-by download attack definition: What it really means

A drive-by download attack is a type of cyberthreat where malware can be downloaded and installed on a device automatically without the victim's consent or direct action.

Attackers typically use exploit kits, malvertising, or cross-site scripting to deliver the malware without the victim's knowledge. The term drive-by reflects how simply visiting an infected webpage is enough for the victim's device to be affected.

This type of malicious or unwanted download doesn’t need user permission. By exploiting weak browsers, outdated plug-ins, or vulnerable operating systems, attackers can install harmful software in seconds.

History of drive-by exploits

Drive-by exploits first appeared in the mid-2000s, targeting Internet Explorer through insecure add-ons like ActiveX and Java applets. Soon after, exploit kits such as Angler and Blackhole automated the process by scanning browsers for weaknesses and delivering the right malware payload.

Today, drive-by downloads don’t rely on outdated plug-ins alone. Attackers now inject code through compromised ad networks, malicious JavaScript libraries, and even trusted third-party websites. This evolution makes drive-by malware far harder to detect and block, increasing risks for organizations that delay patching or lack layered defenses.

How drive-by malware works

A drive by infection typically follows this chain of events:

Examples of drive-by download attacks

Malicious ads on major news websites (2016): The ad networks of BBC, NY Times, and several other reputable sites were compromised—when visitors loaded these trusted sites, the malicious scripts hidden behind the ads silently redirected them to servers hosting the Angler exploit kit, which scanned for outdated versions of Adobe Flash and Internet Explorer; without a single click, users were then infected with ransomware and banking trojans.

SocGholish malware campaign (2018): Researchers uncovered a malware campaign called SocGholish that spread through more than 300 compromised websites. Attackers deliberately chose websites that had extensive email marketing campaigns and strong SEO performance. They injected malicious JavaScript into those websites, and when visitors simply browsed these sites, the scripts silently redirected them to download fake browser updates that actually delivered malware designed to steal data and create backdoors.

These cases show that drive-by attacks can occur even when we visit reputable websites.

How to prevent drive-by downloads

Drive-by downloads are sneaky and common, but the risk of one can be reduced drastically with a layered defense strategy.

Here's a quick checklist that end users and sysadmins can use to implement a foolproof plan to prevent drive-by attacks.

Drive-by download prevention checklist for end users

• Patch and update everything promptly. Start with:
  • Operating system
  • Web browser
  • Browser extensions
• Use modern browser defenses, including:
  • Enable safe browsing features (Enhanced Protection for Chrome, SmartScreen for Edge, etc.).
  • Auto-block unsafe downloads.
  • Sign in using non-administrative accounts so drive-by infections can’t install silently.
• Block or reduce ads and scripts. There are reputable ad blockers and script blockers that can stop malicious ads from rendering.
• Reduce the attack surface:
  • Remove or disable unused browser plug-ins (Flash, Java, and old extensions).
  • Don’t install random toolbars or unknown applications.

Drive-by download prevention checklist for CISOs and sysadmins

• Use enterprise-grade browsers or managed policies. Enforce:
  • Download restrictions that control what files users can download.
  • Extensions allowlists that permit only specific add-ons.
  • Navigation policies that define browser behavior on websites like redirects, pop-ups, and unsafe downloads.
• Enable DNS and web filtering. Block known malicious domains that hosts exploit kits.
• Deploy good endpoint and cloud access security broker (CASB) software:
  • Implement application control to block categories of web apps that are known to be malicious or spam.
  • Enable anti-malware and EDR systems.
  • Allowlist web applications.
  • Prevent unknown executables from running.
  • Use EDR to detect suspicious behavior.
  • Enable a fast, prioritized patch program.
• Train users on the impact of cyberattacks, since even trusted sites can carry drive-by attacks.

What are the immediate steps after a suspected drive-by infection?

• Isolate the compromised device from the network.
• Do a full scan with antivirus and EDR solutions, and collect indicators (suspicious files, processes, etc).
• Preserve logs and snapshot the machine if possible for forensics.
• Remove unknown applications or roll back to known good snapshot only after a full scan and verification.
  • If it’s ransomware or another active intrusion, follow your incident response playbook and notify relevant authorities.
• Update credentials if you suspect they were exposed.

Frequently Asked Questions